<def-group>
  <definition class="compliance" id="directory_access_var_log_audit" version="1">
    {{{ oval_metadata("Audit rules about the read events to /var/log/audit") }}}

    <criteria operator="OR">

      <!-- Test the augenrules case -->
      <criteria operator="AND">
        <extend_definition comment="audit augenrules" definition_ref="audit_rules_augenrules" />
        <criterion comment="audit augenrules 32-bit rule to record read access events to /var/log/audit" test_ref="test_{{{ rule_id }}}_augenrules_32bit" />
        <criteria operator="OR">
          <!-- System either isn't 64-bit => we just check presence of 32-bit version of audit rule -->
          <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
          <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of audit rule -->
          <criterion comment="audit augenrules 64-bit rule to record read access events to /var/log/audit" test_ref="test_{{{ rule_id }}}_augenrules_64bit" />
        </criteria>
      </criteria>

      <!-- Test the auditctl case -->
      <criteria operator="AND">
        <extend_definition comment="audit auditctl" definition_ref="audit_rules_auditctl" />
        <criterion comment="audit auditctl 32-bit rule to record read access events to /var/log/audit" test_ref="test_{{{ rule_id }}}_auditctl_32bit" />
        <criteria operator="OR">
          <!-- System either isn't 64-bit => we just check presence of 32-bit version of the audit rule -->
          <extend_definition comment="64-bit system" definition_ref="system_info_architecture_64bit" negate="true" />
          <!-- Or system is 64-bit => in that case we also need to verify the presence of 64-bit version of audit rule -->
          <criterion comment="audit auditctl 64-bit rule to record read access events to /var/log/audit" test_ref="test_{{{ rule_id }}}_auditctl_64bit" />
        </criteria>
      </criteria>
    </criteria>
  </definition>

{{% macro test_directory_acccess_var_log_audit(audit_tool, filepath, bits) %}}
  <ind:textfilecontent54_test check="all" check_existence="only_one_exists" comment="audit {{{ audit_tool }}} {{{ NAME }}}" id="test_{{{ rule_id }}}_{{{ audit_tool }}}_{{{ bits }}}bit" version="1">
    <ind:object object_ref="object_{{{ rule_id }}}_{{{ audit_tool }}}_{{{ bits }}}bit" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_{{{ rule_id }}}_{{{ audit_tool }}}_{{{ bits }}}bit" version="1">
    <ind:filepath operation="pattern match">{{{ filepath }}}</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*-a[\s]+always,exit[\s]+-F[\s]+arch=b{{{ bits }}}[\s]+(?:-F[\s]+dir=/var/log/audit/)[\s]+(?:-F[\s]+perm=r)[\s]+(?:-F\s+auid>={{{ auid }}}[\s]+)(?:-F\s+auid!=(unset|4294967295)[\s]+)(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
{{% endmacro %}}

{{{ test_directory_acccess_var_log_audit("augenrules", "^/etc/audit/rules\.d/.*\.rules$", "32") }}}
{{{ test_directory_acccess_var_log_audit("augenrules", "^/etc/audit/rules\.d/.*\.rules$", "64") }}}
{{{ test_directory_acccess_var_log_audit("auditctl", "/etc/audit/audit.rules", "32") }}}
{{{ test_directory_acccess_var_log_audit("auditctl", "/etc/audit/audit.rules", "64") }}}

</def-group>
