macros-oval.jinja

{{#
  Constants.
#}}
{{%- set suffix_id_default_not_overriden = "_default_not_overriden" -%}}

{{#
  High level macro which checks if a particular combination of parameter and value in a configuration file is set.
  This macro can take ten parameters:
    - path (String): Path to the configuration file to be checked.
    - prefix_regex (String): Regular expression to be used in the beginning of the OVAL text file content check.
    - parameter (String): The parameter to be checked in the configuration file.
    - value (String): The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
    - separator_regex (String): Regular expression to be used as the separator of parameter and value in a configuration file. If spaces are allowed, this should be included in the regular expression.
    - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
    - application (String): The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
    - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
    - missing_config_file_fail (boolean): If set, the check will fail if the configuration is not existent in the system.
    - section (String): If set, the parameter will be checked only within the given section defined by [section].
    - quotes (String): If non-empty, one level of matching quotes is considered when checking the value. See comment of oval_line_in_file_state for more info.
#}}
{{%- macro oval_check_config_file(path='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', value='', missing_parameter_pass=false, application='', multi_value=false, missing_config_file_fail=false, section='', quotes='') -%}}
{{%- if application == '' -%}}
	{{%- set application = "The respective application or service" -%}}
{{%- endif -%}}
<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    <metadata>
      <title>{{{ rule_title }}}</title>
      {{{- oval_affected(products) }}}
      <description>Ensure '{{{ parameter }}}' is configured with value '{{{ value | replace("(?i)", "") | replace("(?-i)", "")}}}' {{% if section -%}} in section '{{{ section }}}' {{% endif -%}} in '{{{ path }}}'</description>
    </metadata>
    {{%- if missing_config_file_fail %}}
    <criteria comment="{{{ application }}} is configured correctly and configuration file exists"
    operator="AND">
    {{%- endif %}}
    {{%- if application == "sshd" %}}
{{#-
    This condition is here to avoid regression in sshd configuration rules.
    The OVAL checks for sshd configuration test if the package is installed
    and if it is required or not by the profile. When rule applicability is
    done for these rules, it can be removed.
#}}
    <criteria comment="{{{ application }}} is configured correctly or is not installed"
    operator="OR">
        {{{- application_not_required_or_requirement_unset() }}}
        {{{- application_required_or_requirement_unset() }}}
    {{%- endif %}}
    <criteria comment="{{{ application }}} is configured correctly"
    operator="OR">
        {{{- oval_line_in_file_criterion(path, parameter) }}}
        {{%- if missing_parameter_pass %}}
        {{{- oval_line_in_file_criterion(path, parameter, missing_parameter_pass) }}}
        {{%- endif %}}
    </criteria>
    {{%- if application == "sshd" %}}
    </criteria> {{# close criteria left open in application_required_or_requirement_unset #}}
    </criteria>
    {{%- endif %}}
    {{%- if missing_config_file_fail %}}
        {{{- oval_config_file_exists_criterion(path) }}}
    </criteria>
    {{%- endif %}}
  </definition>
  {{{ oval_line_in_file_test(path, parameter) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, false, multi_value) }}}
  {{{ oval_line_in_file_state(value, multi_value, quotes) }}}
  {{%- if missing_parameter_pass %}}
  {{{ oval_line_in_file_test(path, parameter, missing_parameter_pass) }}}
  {{{ oval_line_in_file_object(path, section, prefix_regex, parameter, separator_regex, missing_parameter_pass, multi_value) }}}
  {{%- endif %}}
  {{%- if missing_config_file_fail %}}
  {{{ oval_config_file_exists_test(path) }}}
  {{{ oval_config_file_exists_object(path) }}}
  {{%- endif %}}

</def-group>
{{%- endmacro %}}

{{#
  Macro to define the criterion of the OVAL check (Criterion definition).
  This macro can take three parameters:
    - path (String): Path to the configuration file to be checked.
    - parameter (String): The parameter to be checked in the configuration file.
    - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
#}}
{{%- macro oval_line_in_file_criterion(path='', parameter='', missing_parameter_pass=false) -%}}
{{%- set suffix_id = "" -%}}
{{%- set prefix_text = "Check the" -%}}
{{%- if missing_parameter_pass %}}
{{%- set suffix_id = suffix_id_default_not_overriden -%}}
{{%- set prefix_text = prefix_text + " absence of" -%}}
{{%- endif %}}
      <criterion comment="{{{ prefix_text }}} {{{ parameter }}} in {{{ path }}}"
      test_ref="test_{{{ rule_id }}}{{{ suffix_id }}}" />
{{%- endmacro %}}

{{#
  Macro to define the OVAL test to be constructed (Test definition).
  This macro can take three parameters:
    - path (String): Path to the configuration file to be checked.
    - parameter (String): The parameter to be checked in the configuration file.
    - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
#}}
{{%- macro oval_line_in_file_test(path='', parameter='', missing_parameter_pass=false) -%}}
{{%- set suffix_id = "" -%}}
{{%- if missing_parameter_pass %}}
{{%- set check_existence = "none_exist" -%}}
{{%- set prefix_text = "absence" -%}}
{{%- set suffix_id = suffix_id_default_not_overriden -%}}
{{%- else %}}
{{%- set check_existence = "all_exist" -%}}
{{%- set prefix_text = "value" -%}}
{{%- endif %}}
  <ind:textfilecontent54_test check="all" check_existence="{{{ check_existence }}}"
  comment="tests the {{{ prefix_text }}} of {{{ parameter }}} setting in the {{{ path }}} file"
  id="test_{{{ rule_id }}}{{{ suffix_id }}}" version="1">
  <ind:object object_ref="obj_{{{ rule_id }}}{{{ suffix_id }}}" />
  {{%- if not missing_parameter_pass %}}
  <ind:state state_ref="state_{{{ rule_id }}}{{{ suffix_id }}}" />
  {{%- endif %}}
  </ind:textfilecontent54_test>
{{%- endmacro %}}

{{#
  Macro to check if a parameter in a configuration file is set (Object definition).
  This macro can take six parameters:
    - path (String): Path to the configuration file to be checked.
    - section (String): If set, the parameter will be checked only within the given section defined by [section].
    - prefix_regex (String): Regular expression to be used in the beginning of the OVAL text file content check.
    - parameter (String): The parameter to be checked in the configuration file.
    - separator_regex (String): Regular expression to be used as the separator of parameter and value in a configuration file. If spaces are allowed, this should be included in the regular expression.
    - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
    - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
#}}
{{%- macro oval_line_in_file_object(path='', section='', prefix_regex='^[ \\t]*', parameter='', separator_regex='[ \\t]+', missing_parameter_pass=false, multi_value=false) -%}}
{{%- set suffix_id = "" -%}}
{{%- if multi_value -%}}
{{%- set group_regex = "([^#]*).*$" -%}}
{{%- else -%}}
{{%- set group_regex = "(.+?)[ \\t]*(?:$|#)" -%}}
{{%- endif -%}}
{{%- if section %}}
{{%- set common_regex = "^\s*\["+section+"\].*(?:\\n\s*[^[\s].*)*\\n"+prefix_regex+parameter+separator_regex -%}}
{{%- if missing_parameter_pass %}}
{{#
  There is no need for having a regular expression with a capture
  group "(\S*)" when checking if the parameter is not present in
  the configuration file.
#}}
{{%- set regex = common_regex -%}}
{{%- else %}}
{{%- set regex = common_regex+group_regex -%}}
{{%- endif %}}
{{%- else %}}
{{%- if missing_parameter_pass %}}
{{%- set suffix_id = suffix_id_default_not_overriden -%}}
{{#
  There is no need for having a regular expression with a capture
  group "(.*)" when checking if the parameter is not present in
  the configuration file.
#}}
{{%- set regex = prefix_regex+parameter+separator_regex -%}}
{{%- else %}}
{{%- set regex = prefix_regex+parameter+separator_regex+group_regex -%}}
{{%- endif %}}
{{%- endif %}}
  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}{{{ suffix_id }}}" version="1">
    <ind:filepath>{{{ path }}}</ind:filepath>
    <ind:pattern operation="pattern match">{{{ regex }}}</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
{{%- endmacro %}}

{{#
  Macro to check if a expected value can be found in the extracted information of an OVAL object (State definition).
  This macro can take two parameters:
    - value (String): The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
    - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
    - quotes (String): If non-empty, one level of matching quotes is considered when checking the value. Specify one or more quote types as a string.
      For example, for shell quoting, specify quotes="'\""), which will make sure that value, 'value' and "value" are matched, but 'value" or '"value"' won't be.
#}}
{{%- macro oval_line_in_file_state(value='', multi_value='', quotes='') -%}}
{{%- set regex = value -%}}
{{%- if quotes != "" %}}
{{%- if "\\1" in value > 0 %}}
{{{ raise("The regex for matching '%s' already references capturing groups, which doesn't go well with quoting that adds a capturing group to the beginning." % value) }}}
{{%- endif %}}
{{%- set regex =  "((?:%s)?)%s\\1" % ("|".join(quotes), regex) -%}}
{{%- endif %}}
{{%- if multi_value %}}
{{%- set regex = "^.*\\b"+regex+"\\b.*$" -%}}
{{%- else %}}
{{%- set regex = "^"+regex+"$" -%}}
{{%- endif %}}
  <ind:textfilecontent54_state id="state_{{{ rule_id }}}" version="1">
    <ind:subexpression datatype="string" operation="pattern match">{{{ regex }}}</ind:subexpression>
  </ind:textfilecontent54_state>
{{%- endmacro %}}

{{#
  Macro to define the OVAL criterion to check if the configuration file exists (Criterion definition).
  This macro can take one parameter:
    - path (String): Path to the configuration file to be checked.
#}}
{{%- macro oval_config_file_exists_criterion(path='') -%}}
	<criterion comment="test if configuration file {{{ path }}} exists for {{{ rule_id }}}" test_ref="test_{{{ rule_id }}}_config_file_exists" />
{{%- endmacro %}}

{{#
  Macro to define the OVAL test to check if the configuration file exists (Test definition).
  This macro can take one parameter:
    - path (String): Path to the configuration file to be checked.
#}}
{{%- macro oval_config_file_exists_test(path='') -%}}
  <unix:file_test id="test_{{{ rule_id }}}_config_file_exists" check="all" check_existence="all_exist" comment="The configuration file {{{ path }}} exists for {{{ rule_id }}}" version="1">
    <unix:object object_ref="obj_{{{ rule_id }}}_config_file" />
  </unix:file_test>
{{%- endmacro %}}

{{#
  Macro to define the OVAL criterion that requires a file not to exist.
  Parameters:
    - filepath (String): Path to the file to be checked.
    - id of the test name - the test will be named test_<id>
#}}
{{%- macro oval_file_absent_criterion(filepath, id) -%}}
	<criterion comment="Pass if {{{ filepath }}} does not exist" test_ref="test_{{{ id }}}" />
{{%- endmacro %}}

{{#
  Macro to define the OVAL test to check if the configuration file exists (Test definition).
  Parameters:
    - filepath (String): Path to the configuration file to be checked.
    - id of the test name - the test will be named test_<id>, the respective object object_<id> etc.
#}}
{{%- macro oval_file_absent(filepath, id) -%}}
  <unix:file_test check="all" check_existence="none_exist" comment="{{{ filepath }}} does not exist" id="test_{{{ id }}}" version="1">
    <unix:object object_ref="object_{{{ id }}}" />
  </unix:file_test>
  <unix:file_object id="object_{{{ id }}}" version="1">
    <unix:filepath>{{{ filepath }}}</unix:filepath>
  </unix:file_object>
{{%- endmacro %}}

{{#
  Macro to define the OVAL object to check if the configuration file exists (Object definition).
  This macro can take one parameter:
    - path (String): Path to the configuration file to be checked.
#}}
{{%- macro oval_config_file_exists_object(path='') -%}}
  <unix:file_object id="obj_{{{ rule_id }}}_config_file" comment="The configuration file {{{ path }}} for {{{ rule_id }}}" version="1">
    <unix:filepath operation="pattern match">^{{{ path }}}</unix:filepath>
  </unix:file_object>
{{%- endmacro %}}

{{#
  High level macro to check if a particular combination of parameter and value in the ssh daemon configuration file is set.
  This macro can take five parameters:
    - parameter (String): The parameter to be checked in the configuration file.
    - value (String): The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
    - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
    - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
    - missing_config_file_fail (boolean): If set, the check will fail if the configuration file doesn't exist in the system.

  We specify a case insensitive comparison in the prefix because
  sshd_config has case-insensitive parameters (but case-sensitive values).
#}}
{{%- macro oval_sshd_config(parameter='', value='', missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
{{{ oval_check_config_file("/etc/ssh/sshd_config", prefix_regex="^[ \\t]*(?i)", parameter=parameter, separator_regex='(?-i)[ \\t]+', value=value, missing_parameter_pass=missing_parameter_pass, application="sshd", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail) }}}
{{%- endmacro %}}

{{#
  High level macro to check if a particular shell variable is set.
  This macro can take five parameters:
    - path (String): Path to the file.
    - parameter (String): The shell variable name.
    - value (String): The variable value WITHOUT QUOTES.
    - application (String): The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
    - no_quotes (boolean): If set, the check will require that the RHS of the assignment is the literal value, without quotes.
        If no_quotes is false, then one level of single or double quotes won't be regarded as part of the value by the check.
    - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
    - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
    - missing_config_file_fail (boolean): If set, the check will fail if the configuration file doesn't exist in the system.
#}}
{{%- macro oval_check_shell_file(path, parameter='', value='', application='', no_quotes=false, missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
{{% if no_quotes -%}}
{{%- set quotes = "" -%}}
{{%- else -%}}
{{%- set quotes = "\"'" -%}}
{{%- endif -%}}
{{{ oval_check_config_file(path, prefix_regex="^[ \\t]*", parameter=parameter, separator_regex='=', value=value, missing_parameter_pass=missing_parameter_pass, application=application, multi_value=multi_value, missing_config_file_fail=missing_config_file_fail, quotes=quotes) }}}
{{%- endmacro %}}

{{#
  High level macro to check if a particular combination of parameter and value in the Audit daemon configuration file is set.
  This function can take five parameters:
    - parameter (String): The parameter to be checked in the configuration file.
    - value (String): The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
    - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
    - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
    - missing_config_file_fail (boolean): If set, the check will fail if the configuration file doesn't exist in the system.
#}}
{{%- macro oval_auditd_config(parameter='', value='', missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
{{{ oval_check_config_file("/etc/audit/auditd.conf", prefix_regex="^[ \\t]*(?i)", parameter=parameter, separator_regex='(?-i)[ \\t]*=[ \\t]*', value="(?i)"+value+"(?-i)", missing_parameter_pass=missing_parameter_pass, application="auditd", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail) }}}
{{%- endmacro %}}

{{#
  High level macro to set a parameter in /etc/systemd/coredump.conf.
  This function can take five parameters:
    - parameter (String): The parameter to be checked in the configuration file.
    - value (String): The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
    - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
    - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
    - missing_config_file_fail (boolean): If set, the check will fail if the configuration is not existent in the system.

#}}
{{%- macro oval_coredump_config_set(parameter='', value='', missing_parameter_pass=false, multi_value=false, missing_config_file_fail=false) %}}
{{{ oval_check_config_file("/etc/systemd/coredump.conf", prefix_regex="^[ \\t]*(?i)", parameter=parameter, separator_regex='(?-i)[ \\t]*=[ \\t]*', value="(?i)"+value+"(?-i)", missing_parameter_pass=missing_parameter_pass, application="systemd-coredump", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail, section="Coredump") }}}
{{%- endmacro %}}

{{#
  High level macro to check if a particular combination of parameter and value in the grub configuration file is set.
  This macro can take five parameters:
    - parameter (String): The parameter to be checked in the configuration file.
    - value (String): The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
    - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
    - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
    - missing_config_file_fail (boolean): If set, the check will fail if the configuration is not existent in the system.
#}}
{{%- macro oval_grub_config(parameter='', value='', missing_parameter_pass=false, multi_value=true, missing_config_file_fail=false) %}}
{{{ oval_check_config_file("/etc/default/grub", prefix_regex="^[ \\t]*", parameter=parameter, separator_regex='=', value=value, missing_parameter_pass=missing_parameter_pass, application="grub", multi_value=multi_value, missing_config_file_fail=missing_config_file_fail) }}}
{{%- endmacro %}}

{{#
  To be removed macro. Prevents regression on sshd configuration rules.
#}}
{{%- macro application_not_required_or_requirement_unset() -%}}
      <criteria comment="sshd is not installed" operator="AND">
        <extend_definition comment="sshd is not required or requirement is unset"
        definition_ref="sshd_not_required_or_unset" />
        {{% if product in ['opensuse', 'sle11', 'sle12'] %}}
        <extend_definition comment="rpm package openssh removed"
        definition_ref="package_openssh_removed" />
        {{% else %}}
        <extend_definition comment="rpm package openssh-server removed"
        definition_ref="package_openssh-server_removed" />
        {{% endif %}}
      </criteria>
{{%- endmacro %}}
{{#
  To be removed macro. Prevents regression on sshd configuration rules.
#}}
{{%- macro application_required_or_requirement_unset() -%}}
      <criteria comment="sshd is installed and configured" operator="AND">
        <extend_definition comment="sshd is required or requirement is unset"
        definition_ref="sshd_required_or_unset" />
        {{% if product in ['opensuse', 'sle11', 'sle12'] %}}
        <extend_definition comment="rpm package openssh installed"
        definition_ref="package_openssh_installed" />
        {{% else %}}
        <extend_definition comment="rpm package openssh-server installed"
        definition_ref="package_openssh-server_installed" />
        {{% endif %}}
      {{# Note that a criteria was left open #}}
{{%- endmacro %}}

{{#
  High level macro which checks configuration in an INI file.
  This macro can take eight parameters:
    - path (String): Path to the configuration file to be checked.
    - section (String): The parameter will be checked only within the given section defined by [section].
    - parameter (String): The parameter to be checked in the configuration file.
    - value (String): The value to be checked. This can also be a regular expression (e.g: value1|value2 can match both values).
    - missing_parameter_pass (boolean): If set, the check will also pass if the parameter is not present in the configuration file (default is applied).
    - application (String): The application which the configuration file is being checked. Can be any value and does not affect the actual OVAL check.
    - multi_value (boolean): If set, it means that the parameter can accept multiple values and the expected value must be present in the current list of values.
    - missing_config_file_fail (boolean): If set, the check will fail if the configuration is not existent in the system.
#}}
{{%- macro oval_check_ini_file(path='', section='', parameter='', value='', missing_parameter_pass=false, application='', multi_value=false, missing_config_file_fail=true) %}}
{{{ oval_check_config_file(path=path, prefix_regex="^\s*", parameter=parameter, value=value, separator_regex="[ \\t]*=[ \\t]*", missing_parameter_pass=missing_parameter_pass, application=application, multi_value=multi_value, missing_config_file_fail=missing_config_file_fail, section=section) }}}
{{%- endmacro %}}

{{#
  Creates OVAL tests with given test_id which checks if package
  is not installed.
#}}
{{%- macro oval_test_package_removed(package='', test_id='') -%}}
{{% if pkg_system == "rpm" %}}
  <linux:rpminfo_test check="all" check_existence="none_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is removed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
  </linux:rpminfo_test>
  <linux:rpminfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:rpminfo_object>
{{% elif pkg_system == "dpkg" %}}
  <linux:dpkginfo_test check="all" check_existence="none_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is removed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
  </linux:dpkginfo_test>
  <linux:dpkginfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:dpkginfo_object>
{{% endif %}}
{{%- endmacro -%}}

{{#
  Creates OVAL tests with given test_id which checks if package
  is installed. Optionally, it can check if a package of a given version (EVR)
  or newer version is present.
#}}
{{%- macro oval_test_package_installed(package='', evr='', test_id='') -%}}
{{% if pkg_system == "rpm" %}}
  <linux:rpminfo_test check="all" check_existence="all_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is installed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
    {{% if evr %}}
      <linux:state state_ref="ste_{{{ test_id }}}" />
    {{% endif %}}
  </linux:rpminfo_test>
  <linux:rpminfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:rpminfo_object>
  {{% if evr %}}
    <linux:rpminfo_state id="ste_{{{ test_id }}}" version="1">
      <linux:evr datatype="evr_string" operation="greater than or equal">{{{ evr }}}</linux:evr>
    </linux:rpminfo_state>
  {{% endif %}}
{{% elif pkg_system == "dpkg" %}}
  <linux:dpkginfo_test check="all" check_existence="all_exist"
  id="{{{ test_id }}}" version="1"
  comment="package {{{ package }}} is installed">
    <linux:object object_ref="obj_{{{ test_id }}}" />
    {{% if evr %}}
      <linux:state state_ref="ste_{{{ test_id }}}" />
    {{% endif %}}
  </linux:dpkginfo_test>
  <linux:dpkginfo_object id="obj_{{{ test_id }}}" version="1">
    <linux:name>{{{ package }}}</linux:name>
  </linux:dpkginfo_object>
  {{% if evr %}}
    <linux:dpkginfo_state id="ste_{{{ test_id }}}" version="1">
      <linux:evr datatype="evr_string" operation="greater than or equal">{{{ evr }}}</linux:evr>
    </linux:dpkginfo_state>
  {{% endif %}}
{{% endif %}}
{{%- endmacro -%}}

{{#
  Macro which generates OVAL test for OpenShift Container Platform
  runtime process configuration.
  Parameters:
    - command - command that executes the OpenShift process
    - option - command line option of the command
    - value - value of the option
    - option_id - used to build the OVAL test ID
  The OVAL test ID is test_ocp_runtime_<option_id>.
#}}
{{%- macro oval_ocp_service_runtime_config(command='', option='', value='', option_id='') -%}}
  <unix:process58_test check="all" comment="ocp process runtime parameter {{{ option }}} set to {{{ value }}}" id="test_ocp_runtime_{{{ option_id }}}" version="1">
    <unix:object object_ref="object_ocp_runtime_{{{ option_id }}}" />
    <unix:state state_ref="state_ocp_runtime_{{{ option_id }}}" />
  </unix:process58_test>
  <unix:process58_object id="object_ocp_runtime_{{{ option_id }}}" version="1">
    <unix:command_line operation="pattern match">^{{{ command }}}.*$</unix:command_line>
    <unix:pid datatype="int" operation="greater than">0</unix:pid>
  </unix:process58_object>
  <unix:process58_state id="state_ocp_runtime_{{{ option_id }}}" version="1">
    <unix:command_line operation="pattern match">^.*[\s]+{{{ option }}}=.*({{{ value }}}).*([\s]+.*$|$)</unix:command_line>
  </unix:process58_state>
{{%- endmacro -%}}

{{#
  Macro which generates OVAL definition, test and object that check for contents
  of the file.
  Parameters:
    - filepath - filepath of the file to check
    - contents - contents that should be in the file
#}}
{{%- macro oval_file_contents(filepath='', filepath_id='', contents='') -%}}
  <def-group>
    <definition class="compliance" id="{{{ rule_id }}}" version="1">
      <metadata>
        <title>Check that contents of {{{ filepath }}} are as expected</title>
        {{{- oval_affected(products) }}}
        <description>Inspect the contents of {{{ filepath }}}</description>
      </metadata>
      <criteria>
          <criterion comment="Check contents of file" test_ref="test_whole_file_contents_{{{ filepath_id }}}" />
      </criteria>
    </definition>

    <ind:textfilecontent54_test check="all" check_existence="all_exist"
    comment="Tests if contents of {{{ filepath }}} is exactly what is defined in rule description"
    id="test_whole_file_contents_{{{ filepath_id }}}" version="1">
      <ind:object object_ref="object_whole_file_contents_{{{ filepath_id }}}" />
      <ind:state state_ref="state_whole_file_contents_{{{ filepath_id }}}" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="object_whole_file_contents_{{{ filepath_id }}}" version="1">
      <ind:behaviors singleline="true" multiline="false" />
      <ind:filepath>{{{ filepath }}}</ind:filepath>
      <ind:pattern operation="pattern match">^.*$</ind:pattern>
      <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_state id="state_whole_file_contents_{{{ filepath_id }}}" version="1">
      <ind:text operation="equals">{{{ contents|trim() }}}
</ind:text>
    </ind:textfilecontent54_state>

  </def-group>
{{%- endmacro %}}