path: root/xml/SCAP/gentoo-oval.xml

<?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5"
        xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" 
        xmlns:lin-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux"
        xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
        xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"
        xsi:schemaLocation="
                http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd
                http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd
                http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd
                http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd
                http://standards.iso.org/iso/19770/-2/2009/schema.xsd schema.xsd">

<generator>
  <oval:product_name>OVAL Gentoo Linux</oval:product_name>
  <oval:product_version>20130920.1</oval:product_version>
  <oval:schema_version>5.10</oval:schema_version>
  <oval:timestamp>2013-09-20T15:39:00</oval:timestamp>
</generator>
  
<definitions>

  <definition id="oval:org.gentoo.dev.swift:def:1" version="1" class="inventory">
    <metadata>
      <title>Gentoo Linux is installed</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        This definition tests whether Gentoo Linux is installed.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:1" comment="The /etc/gentoo-release file exists" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:2" version="1" class="compliance">
    <metadata>
      <title>The /home location must be a separate file system</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-14559-9"/>
      <description>
        This definition tests whether the /home location is a separate file
        system.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:2" comment="The /home location is on a separate partition" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:3" version="1" class="compliance">
    <metadata>
      <title>The /home file system is mounted with the nosuid option</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        This definition tests whether the /home partition is mounted with the nosuid 
        mount option.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:2" comment="The /home location is on a separate partition" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:3" comment="The /home partition is mounted with nosuid mount option" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:4" version="1" class="compliance">
    <metadata>
      <title>The /home file system is mounted with the nodev option</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        This definition tests whether the /home partition is mounted with the nodev 
        mount option.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:2" comment="The /home location is on a separate partition" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:4" comment="The /home partition is mounted with nodev mount option" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:5" version="1" class="compliance">
    <metadata>
      <title>The /tmp location must be a separate file system</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-14161-4"/>
      <description>
        This definition tests whether the /tmp location is a separate file
        system.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:5" comment="The /tmp location is on a separate partition" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:6" version="1" class="compliance">
    <metadata>
      <title>The /var location must be a separate file system</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-14777-7"/>
      <description>
        This definition tests whether the /var location is a separate file
        system.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:6" comment="The /var location is on a separate partition" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:7" version="1" class="compliance">
    <metadata>
      <title>The /var/log location must be a separate file system</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-14011-1"/>
      <description>
        This definition tests whether the /var/log location is a separate file
        system.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:7" comment="The /var/log location is on a separate partition" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:8" version="1" class="compliance">
    <metadata>
      <title>The /var/log/audit location must be a separate file system</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-14171-3"/>
      <description>
        This definition tests whether the /var/log/audit location is a separate file
        system.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:8" comment="The /var/log/audit location is on a separate partition" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:9" version="1" class="compliance">
    <metadata>
      <title>The /var file system is mounted with the nodev option</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-4249-9"/>
      <description>
        This definition tests whether the /var partition is mounted with the nodev 
        mount option.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:6" comment="The /var location is on a separate partition" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:9" comment="The /var partition is mounted with nodev mount option" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:10" version="1" class="compliance">
    <metadata>
      <title>The /var/log file system is mounted with the nodev option</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-4249-9"/>
      <description>
        This definition tests whether the /var/log partition is mounted with the nodev 
        mount option.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:7" comment="The /var/log location is on a separate partition" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:10" comment="The /var/log partition is mounted with nodev mount option" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:11" version="1" class="compliance">
    <metadata>
      <title>The /var/log/audit file system is mounted with the nodev option</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-4249-9"/>
      <description>
        This definition tests whether the /var/log/audit partition is mounted with the nodev 
        mount option.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:8" comment="The /var/log/audit location is on a separate partition" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:11" comment="The /var/log/audit partition is mounted with nodev mount option" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:12" version="1" class="compliance">
    <metadata>
      <title>The /tmp file system is mounted with the nodev option</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-4249-9"/>
      <description>
        This definition tests whether the /tmp partition is mounted with the nodev 
        mount option.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:5" comment="The /tmp location is on a separate partition" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:12" comment="The /tmp partition is mounted with nodev mount option" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:13" version="1" class="compliance">
    <metadata>
      <title>The /tmp file system is mounted with the nosuid option</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-14940-1"/>
      <description>
        This definition tests whether the /tmp partition is mounted with the nosuid
        mount option.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:5" comment="The /tmp location is on a separate partition" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:13" comment="The /tmp partition is mounted with nosuid mount option" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:14" version="1" class="compliance">
    <metadata>
      <title>The /dev/shm file system is mounted with the nosuid option</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-14306-5"/>
      <description>
        This definition tests whether the /dev/shm partition is mounted with the nosuid
        mount option.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:14" comment="The /dev/shm location is a separate file system" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:15" comment="The /dev/shm file system is mounted with nosuid mount option" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:15" version="1" class="compliance">
    <metadata>
      <title>The /tmp file system is mounted with the noexec option</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-14927-8"/>
      <description>
        This definition tests whether the /tmp partition is mounted with the noexec
        mount option.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:5" comment="The /tmp location is on a separate partition" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:16" comment="The /tmp partition is mounted with noexec mount option" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:16" version="1" class="compliance">
    <metadata>
      <title>The /dev/shm file system is mounted with the noexec option</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-14703-3"/>
      <description>
        This definition tests whether the /dev/shm partition is mounted with the noexec
        mount option.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:14" comment="The /dev/shm location is a separate file system" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:17" comment="The /dev/shm file system is mounted with nosuid mount option" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:17" version="1" class="compliance">
    <metadata>
      <title>The /var/tmp location is on a separate file system</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-14584-7"/>
      <description>
        This definition tests whether the /var/tmp location is on its own file system.
      </description>
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:18" comment="The /var/tmp location is a separate file system" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:18" version="1" class="compliance">
    <metadata>
      <title>The kernel is build with quota support (CONFIG_QUOTA)</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        This definition tests whether the Linux kernel is build with quota support (CONFIG_QUOTA).
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:19" comment="The Linux kernel is build with CONFIG_QUOTA" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:19" version="1" class="compliance">
    <metadata>
      <title>No process matching "telnetd" is running</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-3390-2" />
      <description>
        This definition tests if no telnet daemon processes are running.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:20" comment="No telnet daemons are running" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:20" version="1" class="compliance">
    <metadata>
      <title>No process matching "ftpd" is running</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-4273-9" />
      <description>
        This definition tests if no FTP daemon processes are running.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:21" comment="No FTP daemons are running" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:21" version="1" class="compliance">
    <metadata>
      <title>rc.conf's rc_shell should be set to /sbin/sulogin</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-4241-6" />
      <description>
        This definition tests if rc_shell in /etc/rc.conf is set to /sbin/sulogin, ensuring
        that single user boots still require the root password to be provided.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:22" comment="/etc/rc.conf rc_shell is set to /sbin/sulogin" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:22" version="1" class="compliance">
    <metadata>
      <title>Single user definitions in inittab should only refer to '/sbin/rc single' or '/sbin/sulogin'</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <reference source="CCE" ref_url="http://nvd.nist.gov/cce/index.cfm" ref_id="CCE-4241-6" />
      <description>
        This definition tests if /etc/inittab single user login settings only refers
        to '/sbin/rc single' or '/sbin/sulogin'.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:23" comment="/etc/inittab single user settings refers only to '/sbin/rc single' or '/sbin/sulogin'" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:23" version="1" class="compliance">
    <metadata>
      <title>Verify that /etc/hosts.allow exists</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        This definition tests if /etc/hosts.allow exists. 
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:24" comment="/etc/hosts.allow exists" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:24" version="1" class="compliance">
    <metadata>
      <title>Verify that /etc/at/at.allow exists</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        This definition tests if /etc/at/at.allow exists. 
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:25" comment="/etc/at/at.allow exists" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:25" version="1" class="compliance">
    <metadata>
      <title>/var is mounted with quota option(s)</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        The /var mount should be mounted with usrquota or grpquota mount option.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:26" comment="/var is mounted with usrquota or grpquota" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:26" version="1" class="compliance">
    <metadata>
      <title>/home is mounted with quota option(s)</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        The /home mount should be mounted with usrquota or grpquota mount option.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:27" comment="/home is mounted with usrquota or grpquota" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:27" version="1" class="compliance">
    <metadata>
      <title>In make.conf 'pam' is declared as a global USE flag</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        The USE declaration in make.conf should have 'pam' set as a global USE flag.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:28" comment="'pam' is set as a global USE flag in make.conf" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:28" version="1" class="compliance">
    <metadata>
      <title>In make.conf 'tcpd' is declared as a global USE flag</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        The USE declaration in make.conf should have 'tcpd' set as a global USE flag.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:29" comment="'tcpd' is set as a global USE flag in make.conf" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:29" version="1" class="compliance">
    <metadata>
      <title>In make.conf 'ssl' is declared as a global USE flag</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        The USE declaration in make.conf should have 'ssl' set as a global USE flag.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:30" comment="'ssl' is set as a global USE flag in make.conf" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:30" version="1" class="compliance">
    <metadata>
      <title>In make.conf 'webrsync-gpg' is set in FEATURES</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        The FEATURES declaration in make.conf should have 'webrsync-gpg' set.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:31" comment="'webrsync-gpg' is set in make.conf FEATURES" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:31" version="1" class="compliance">
    <metadata>
      <title>In make.conf PORTAGE_GPG_DIR is set</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        The PORTAGE_GPG_DIR declaration in make.conf has a non-empty value.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:32" comment="In make.conf PORTAGE_GPG_DIR is non-empty" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:32" version="1" class="compliance">
    <metadata>
      <title>In /etc/securetty only console and tty# exists</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        The /etc/securetty file only contains console and tty# entries
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:33" comment="In /etc/securetty, only console and tty# are defined" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:33" version="1" class="compliance">
    <metadata>
      <title>/proc is mounted with hidepid=1 or hidepid=2</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        The /proc file system should be mounted with hidepid=1 or 2 so that other users' processes are not visible to non-authorized accounts.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:34" comment="/proc is mounted with hidepid=1 or hidepid=2" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:34" version="1" class="compliance">
    <metadata>
      <title>/boot/grub/grub.conf has a password set</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        If /boot/grub/grub.conf exists, then it must have a password set.
      </description>
    </metadata>
    <criteria operator="OR">
      <criteria operator="AND">
        <criterion test_ref="oval:org.gentoo.dev.swift:tst:37" comment="/boot/grub exists" />
        <criterion test_ref="oval:org.gentoo.dev.swift:tst:35" comment="/boot/grub/grub.conf does not exist" />
      </criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:36" comment="GRUB Legacy configuration has a password set" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:35" version="1" class="compliance">
    <metadata>
      <title>/etc/lilo.conf has a password set</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        If /etc/lilo.conf exists, then it must have a password set.
      </description>
    </metadata>
    <criteria operator="OR">
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:38" comment="/etc/lilo.conf does not exist" />
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:39" comment="/etc/lilo.conf has a password set" />
    </criteria>
  </definition>

  <definition id="oval:org.gentoo.dev.swift:def:36" version="1" class="compliance">
    <metadata>
      <title>All world writable directories have the sticky bit set</title>
      <affected family="unix">
        <platform>Gentoo Linux</platform>
      </affected>
      <description>
        All world writable directories must have the sticky bit set.
      </description>
    </metadata>
    <criteria>
      <criterion test_ref="oval:org.gentoo.dev.swift:tst:40" comment="All world writable directories have the sticky bit set" />
    </criteria>
  </definition>

</definitions>

<tests>

  <unix-def:file_test id="oval:org.gentoo.dev.swift:tst:1"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /etc/gentoo-release exists">
    <!-- /etc/gentoo-release file -->
    <unix-def:object object_ref="oval:org.gentoo.dev.swift:obj:1" />
  </unix-def:file_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:2" 
    version="1" check="all" check_existence="all_exist" 
    comment="Tests that /home is a separate file system">
    <!-- /home partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:2" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:3"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /home is mounted with nosuid option">
    <!-- /home partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:2" />
    <!-- "nosuid" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:1" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:4"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /home is mounted with nodev option">
    <!-- /home partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:2" />
    <!-- "nodev" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:2" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:5" 
    version="1" check="all" check_existence="all_exist" 
    comment="Tests that /tmp is a separate file system">
    <!-- /tmp partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:3" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:6" 
    version="1" check="all" check_existence="all_exist" 
    comment="Tests that /var is a separate file system">
    <!-- /var partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:4" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:7" 
    version="1" check="all" check_existence="all_exist" 
    comment="Tests that /var/log is a separate file system">
    <!-- /var/log partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:5" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:8" 
    version="1" check="all" check_existence="all_exist" 
    comment="Tests that /var/log/audit is a separate file system">
    <!-- /var/log/audit partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:6" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:9"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /var is mounted with nodev option">
    <!-- /var partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:4" />
    <!-- "nodev" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:2" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:10"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /var/log is mounted with nodev option">
    <!-- /var/log partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:5" />
    <!-- "nodev" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:2" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:11"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /var/log/audit is mounted with nodev option">
    <!-- /var/log/audit partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:6" />
    <!-- "nodev" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:2" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:12"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /tmp is mounted with nodev option">
    <!-- /tmp partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:3" />
    <!-- "nodev" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:2" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:13"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /tmp is mounted with nosuid option">
    <!-- /tmp partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:3" />
    <!-- "nosuid" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:1" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:14"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /dev/shm is a separate file system">
    <!-- /dev/shm file system -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:7" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:15"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /dev/shm is mounted with nosuid option">
    <!-- /dev/shm file system -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:7" />
    <!-- "nosuid" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:1" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:16"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /tmp is mounted with noexec option">
    <!-- /tmp file system -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:3" />
    <!-- "noexec" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:3" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:17"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /dev/shm is mounted with noexec option">
    <!-- /dev/shm file system -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:7" />
    <!-- "noexec" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:3" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:18"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /var/tmp is on its own file system">
    <!-- /var/tmp file system -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:8" />
  </lin-def:partition_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:19"
    version="2" check="all" check_existence="at_least_one_exists"
    comment="Tests that CONFIG_QUOTA is in the kernel configuration">
    <!-- The file containing kernel configuration matching CONFIG_QUOTA -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:9" />
    <!-- Match for "^CONFIG_QUOTA=[ym]" -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:4" />
  </ind-def:textfilecontent54_test>

  <unix-def:process58_test id="oval:org.gentoo.dev.swift:tst:20"
    version="1" check="all" check_existence="none_exist"
    comment="Tests that no telnet daemons are running">
    <!-- Process matching "telnetd" -->
    <unix-def:object object_ref="oval:org.gentoo.dev.swift:obj:10" />
  </unix-def:process58_test>

  <unix-def:process58_test id="oval:org.gentoo.dev.swift:tst:21"
    version="1" check="all" check_existence="none_exist"
    comment="Tests that no FTP daemons are running">
    <!-- Process matching "ftpd" -->
    <unix-def:object object_ref="oval:org.gentoo.dev.swift:obj:11" />
  </unix-def:process58_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:22"
    version="1" check="at least one" check_existence="all_exist"
    comment="Tests that rc_shell in /etc/rc.conf is set to /sbin/sulogin">
    <!-- The variable settings in /etc/rc.conf -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:12" />
    <!-- Match for rc_shell=/sbin/sulogin -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:5" />
  </ind-def:textfilecontent54_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:23"
    version="1" check="all" check_existence="at_least_one_exists"
    comment="Tests that single-user boot only triggers '/sbin/rc single' or '/sbin/sulogin'">
    <!-- The single-user boot rules in /etc/inittab -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:13" />
    <!-- The '/sbin/rc single' or '/sbin/sulogin' matches -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:6" />
  </ind-def:textfilecontent54_test>

  <unix-def:file_test id="oval:org.gentoo.dev.swift:tst:24"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /etc/hosts.allow exists">
    <!-- The /etc/hosts.allow file -->
    <unix-def:object object_ref="oval:org.gentoo.dev.swift:obj:14" />
  </unix-def:file_test>

  <unix-def:file_test id="oval:org.gentoo.dev.swift:tst:25"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /etc/at/at.allow exists">
    <!-- The /etc/at/at.allow file -->
    <unix-def:object object_ref="oval:org.gentoo.dev.swift:obj:15" />
  </unix-def:file_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:26"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /var is mounted with usrquota or grpquota option">
    <!-- /var file system -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:16" />
    <!-- "usrquota" or "grpquota" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:7" />
  </lin-def:partition_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:27"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /home is mounted with usrquota or grpquota option">
    <!-- /home file system -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:2" />
    <!-- "usrquota" or "grpquota" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:7" />
  </lin-def:partition_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:28"
    version="1" check="at least one" check_existence="all_exist"
    comment="Tests that 'pam' is set as a global USE flag in make.conf">
    <!-- USE declaration in make.conf -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:17" />
    <!-- Match for pam -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:8" />
  </ind-def:textfilecontent54_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:29"
    version="1" check="at least one" check_existence="all_exist"
    comment="Tests that 'tcpd' is set as a global USE flag in make.conf">
    <!-- USE declaration in make.conf -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:17" />
    <!-- Match for tcpd -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:9" />
  </ind-def:textfilecontent54_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:30"
    version="1" check="at least one" check_existence="all_exist"
    comment="Tests that 'ssl' is set as a global USE flag in make.conf">
    <!-- USE declaration in make.conf -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:17" />
    <!-- Match for ssl -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:10" />
  </ind-def:textfilecontent54_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:31"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that webrsync-gpg is set in make.conf FEATURES">
    <!-- FEATURES declaration in make.conf -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:18" />
    <!-- Match for webrsync-gpg -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:11" />
  </ind-def:textfilecontent54_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:32"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that PORTAGE_GPG_DIR is non-empty">
    <!-- PORTAGE_GPG_DIR declaration in make.conf -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:19" />
    <!-- Match for non-empty value -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:12" />
  </ind-def:textfilecontent54_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:33"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that securetty only contains console and tty#">
    <!-- /etc/securetty file -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:20" />
    <!-- console or tty# -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:13" />
  </ind-def:textfilecontent54_test>

  <lin-def:partition_test id="oval:org.gentoo.dev.swift:tst:34"
    version="1" check="all" check_existence="all_exist"
    comment="Tests that /proc is mounted with hidepid=1 or hidepid=2 option">
    <!-- /proc partition -->
    <lin-def:object object_ref="oval:org.gentoo.dev.swift:obj:21" />
    <!-- "hidepid=[12]" mount option -->
    <lin-def:state state_ref="oval:org.gentoo.dev.swift:ste:14" />
  </lin-def:partition_test>

  <unix-def:file_test id="oval:org.gentoo.dev.swift:tst:35"
    version="1" check="all" check_existence="none_exist"
    comment="/boot/grub/grub.conf does not exist">
    <!-- The /boot/grub/grub.conf file -->
    <unix-def:object object_ref="oval:org.gentoo.dev.swift:obj:22" />
  </unix-def:file_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:36"
    comment="The grub.conf file has a password --md5 entry"
    version="1" check="at least one" check_existence="at_least_one_exists">
    <!-- The /boot/grub/grub.conf file content -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:23" />
    <!-- A "password - -md5 somevalue" match -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:15" />
  </ind-def:textfilecontent54_test>

  <unix-def:file_test id="oval:org.gentoo.dev.swift:tst:37"
    version="1" check="all" check_existence="all_exist"
    comment="/boot/grub exists">
    <!-- The /boot/grub location exists -->
    <unix-def:object object_ref="oval:org.gentoo.dev.swift:obj:24" />
  </unix-def:file_test>

  <unix-def:file_test id="oval:org.gentoo.dev.swift:tst:38"
    version="1" check="all" check_existence="none_exist"
    comment="/etc/lilo.conf does not exist">
    <!-- The /etc/lilo.conf file -->
    <unix-def:object object_ref="oval:org.gentoo.dev.swift:obj:25" />
  </unix-def:file_test>

  <ind-def:textfilecontent54_test id="oval:org.gentoo.dev.swift:tst:39"
    comment="lilo.conf has a password set"
    version="1" check="at least one" check_existence="at_least_one_exists">
    <!-- The /etc/lilo.conf content -->
    <ind-def:object object_ref="oval:org.gentoo.dev.swift:obj:26" />
    <!-- A password=somevalue match -->
    <ind-def:state state_ref="oval:org.gentoo.dev.swift:ste:16" />
  </ind-def:textfilecontent54_test>

  <unix-def:file_test id="oval:org.gentoo.dev.swift:tst:40"
    comment="All world writable directories have the sticky bit set"
    version="1" check="all" check_existence="all_exist">
    <!-- All world writable directories -->
    <unix-def:object object_ref="oval:org.gentoo.dev.swift:obj:27" />
    <!-- sticky bit is set -->
    <unix-def:state state_ref="oval:org.gentoo.dev.swift:ste:17" />
  </unix-def:file_test>

</tests>

<objects>

  <unix-def:file_object id="oval:org.gentoo.dev.swift:obj:1"
    version="1" comment="The /etc/gentoo-release file">
    <unix-def:filepath>/etc/gentoo-release</unix-def:filepath>
  </unix-def:file_object>

  <lin-def:partition_object id="oval:org.gentoo.dev.swift:obj:2"
    version="1" comment="The /home partition">
    <lin-def:mount_point>/home</lin-def:mount_point>
  </lin-def:partition_object>

  <lin-def:partition_object id="oval:org.gentoo.dev.swift:obj:3"
    version="1" comment="The /tmp partition">
    <lin-def:mount_point>/tmp</lin-def:mount_point>
  </lin-def:partition_object>

  <lin-def:partition_object id="oval:org.gentoo.dev.swift:obj:4"
    version="1" comment="The /var partition">
    <lin-def:mount_point>/var</lin-def:mount_point>
  </lin-def:partition_object>

  <lin-def:partition_object id="oval:org.gentoo.dev.swift:obj:5"
    version="1" comment="The /var/log partition">
    <lin-def:mount_point>/var/log</lin-def:mount_point>
  </lin-def:partition_object>

  <lin-def:partition_object id="oval:org.gentoo.dev.swift:obj:6"
    version="1" comment="The /var/log/audit partition">
    <lin-def:mount_point>/var/log/audit</lin-def:mount_point>
  </lin-def:partition_object>

  <lin-def:partition_object id="oval:org.gentoo.dev.swift:obj:7"
    version="1" comment="The /dev/shm file system">
    <lin-def:mount_point>/dev/shm</lin-def:mount_point>
  </lin-def:partition_object>

  <lin-def:partition_object id="oval:org.gentoo.dev.swift:obj:8"
    version="1" comment="The /var/tmp file system">
    <lin-def:mount_point>/var/tmp</lin-def:mount_point>
  </lin-def:partition_object>

  <ind-def:textfilecontent54_object id="oval:org.gentoo.dev.swift:obj:9"
    version="2" comment="The file containing kernel configuration CONFIG_QUOTA">
    <ind-def:filepath>/usr/src/linux/.config</ind-def:filepath>
    <ind-def:pattern operation="pattern match">CONFIG_QUOTA.*</ind-def:pattern>
    <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
  </ind-def:textfilecontent54_object>

  <unix-def:process58_object id="oval:org.gentoo.dev.swift:obj:10"
    version="1" comment="Process matching telnetd in its command name">
    <unix-def:command_line operation="pattern match">.*[Tt][Ee][Ll][Nn][Ee][Tt][Dd].*</unix-def:command_line>
    <unix-def:pid datatype="int" operation="greater than">0</unix-def:pid>
  </unix-def:process58_object>

  <unix-def:process58_object id="oval:org.gentoo.dev.swift:obj:11"
    version="1" comment="Process matching ftpd in its command name">
    <unix-def:command_line operation="pattern match">.*[Ff][Tt][Pp][Dd].*</unix-def:command_line>
    <unix-def:pid datatype="int" operation="greater than">0</unix-def:pid>
  </unix-def:process58_object>

  <ind-def:textfilecontent54_object id="oval:org.gentoo.dev.swift:obj:12"
    version="1" comment="The /etc/rc.conf variable declarations">
    <ind-def:filepath>/etc/rc.conf</ind-def:filepath>
    <ind-def:pattern operation="pattern match">^[[:space:]]*[\S]+[[:space:]]*=[[:space:]]*[\S]+</ind-def:pattern>
    <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
  </ind-def:textfilecontent54_object>

  <ind-def:textfilecontent54_object id="oval:org.gentoo.dev.swift:obj:13"
    version="1" comment="The /etc/inittab contents">
    <ind-def:filepath>/etc/inittab</ind-def:filepath>
    <ind-def:pattern operation="pattern match">^[\S]+:S:[\S]+:.*</ind-def:pattern>
    <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
  </ind-def:textfilecontent54_object>

  <unix-def:file_object id="oval:org.gentoo.dev.swift:obj:14"
    version="1" comment="The /etc/hosts.allow file">
    <unix-def:filepath>/etc/hosts.allow</unix-def:filepath>
  </unix-def:file_object>

  <unix-def:file_object id="oval:org.gentoo.dev.swift:obj:15"
    version="1" comment="The /etc/at/at.allow file">
    <unix-def:filepath>/etc/at/at.allow</unix-def:filepath>
  </unix-def:file_object>

  <lin-def:partition_object id="oval:org.gentoo.dev.swift:obj:16"
    version="1" comment="The /var file system">
    <lin-def:mount_point>/var</lin-def:mount_point>
  </lin-def:partition_object>

  <ind-def:textfilecontent54_object id="oval:org.gentoo.dev.swift:obj:17"
    version="2" comment="Portage make.conf global USE settings">
    <ind-def:filepath var_ref="oval:org.gentoo.dev.swift:var:1" />
    <ind-def:pattern operation="pattern match">^USE=.*</ind-def:pattern>
    <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
  </ind-def:textfilecontent54_object>

  <ind-def:textfilecontent54_object id="oval:org.gentoo.dev.swift:obj:18"
    version="1" comment="Portage make.conf FEATURES settings">
    <ind-def:filepath var_ref="oval:org.gentoo.dev.swift:var:1" />
    <ind-def:pattern operation="pattern match">^FEATURES=.*</ind-def:pattern>
    <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
  </ind-def:textfilecontent54_object>

  <ind-def:textfilecontent54_object id="oval:org.gentoo.dev.swift:obj:19"
    version="1" comment="Portage make.conf PORTAGE_GPG_DIR settings">
    <ind-def:filepath var_ref="oval:org.gentoo.dev.swift:var:1" />
    <ind-def:pattern operation="pattern match">^PORTAGE_GPG_DIR="(.*)"</ind-def:pattern>
    <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
  </ind-def:textfilecontent54_object>

  <ind-def:textfilecontent54_object id="oval:org.gentoo.dev.swift:obj:20"
    version="1" comment="/etc/securetty contains only console and tty##">
    <ind-def:filepath>/etc/securetty</ind-def:filepath>
    <ind-def:pattern operation="pattern match">^[^#]+</ind-def:pattern>
    <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
  </ind-def:textfilecontent54_object>

  <lin-def:partition_object id="oval:org.gentoo.dev.swift:obj:21"
    version="1" comment="The /proc file system">
    <lin-def:mount_point>/proc</lin-def:mount_point>
  </lin-def:partition_object>

  <unix-def:file_object id="oval:org.gentoo.dev.swift:obj:22"
    version="1" comment="The /boot/grub/grub.conf file">
    <unix-def:filepath>/boot/grub/grub.conf</unix-def:filepath>
  </unix-def:file_object>

  <ind-def:textfilecontent54_object id="oval:org.gentoo.dev.swift:obj:23"
    version="1" comment="The /boot/grub/grub.conf content">
    <ind-def:filepath>/boot/grub/grub.conf</ind-def:filepath>
    <ind-def:pattern operation="pattern match">^([^#\n]*)(?#.*)?$</ind-def:pattern>
    <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
  </ind-def:textfilecontent54_object>

  <unix-def:file_object id="oval:org.gentoo.dev.swift:obj:24"
    version="1" comment="The /boot/grub location">
    <unix-def:filepath>/boot/grub</unix-def:filepath>
  </unix-def:file_object>

  <unix-def:file_object id="oval:org.gentoo.dev.swift:obj:25"
    version="1" comment="The /etc/lilo.conf file">
    <unix-def:filepath>/etc/lilo.conf</unix-def:filepath>
  </unix-def:file_object>

  <ind-def:textfilecontent54_object id="oval:org.gentoo.dev.swift:obj:26"
    version="1" comment="The /etc/lilo.conf content">
    <ind-def:filepath>/etc/lilo.conf</ind-def:filepath>
    <ind-def:pattern operation="pattern match">^([^#\n]*)(?#.*)?$</ind-def:pattern>
    <ind-def:instance operation="greater than or equal" datatype="int">1</ind-def:instance>
  </ind-def:textfilecontent54_object>

  <unix-def:file_object id="oval:org.gentoo.dev.swift:obj:27"
    version="1" comment="All world writable directories">
    <set set_operator="UNION" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5">
      <!-- All local directories -->
      <object_reference>oval:org.gentoo.dev.swift:obj:28</object_reference>
      <!-- filter out just those with the world-writable bit set -->
      <filter action="exclude">oval:org.gentoo.dev.swift:ste:18</filter> <!-- exclude is default but this is more readable -->
    </set>
  </unix-def:file_object>

  <unix-def:file_object id="oval:org.gentoo.dev.swift:obj:28"
    version="1" comment="All local directories">
    <unix-def:behaviors recurse_direction="down" recurse_file_system="local" recurse="directories"/>
    <unix-def:path>/</unix-def:path>
    <unix-def:filename xsi:nil="true"/>
  </unix-def:file_object>

</objects>

<states>

  <lin-def:partition_state id="oval:org.gentoo.dev.swift:ste:1"
    version="1" comment="The file system is mounted with the nosuid mount option">
    <lin-def:mount_options entity_check="at least one">nosuid</lin-def:mount_options>
  </lin-def:partition_state>

  <lin-def:partition_state id="oval:org.gentoo.dev.swift:ste:2"
    version="1" comment="The file system is mounted with the nodev mount option">
    <lin-def:mount_options entity_check="at least one">nodev</lin-def:mount_options>
  </lin-def:partition_state>

  <lin-def:partition_state id="oval:org.gentoo.dev.swift:ste:3"
    version="1" comment="The file system is mounted with the noexec mount option">
    <lin-def:mount_options entity_check="at least one">noexec</lin-def:mount_options>
  </lin-def:partition_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:4"
    version="1" comment="Matching ^CONFIG_QUOTA=[ym]">
    <ind-def:text datatype="string" operation="pattern match" entity_check="all">^CONFIG_QUOTA=[ym]</ind-def:text>
  </ind-def:textfilecontent54_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:5"
    version="1" comment="Matching rc_shell=/sbin/sulogin">
    <ind-def:text datatype="string" operation="pattern match" entity_check="all">rc_shell[[:space:]]*=[[:space:]]*["]?/sbin/sulogin["]?</ind-def:text>
  </ind-def:textfilecontent54_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:6"
    version="1" comment="Single user boot lines may only match '/sbin/rc single' or '/sbin/sulogin'">
    <ind-def:text datatype="string" operation="pattern match" entity_check="all">su[[:digit:]]+:S:[\S]+:(/sbin/rc single|/sbin/sulogin)</ind-def:text>
  </ind-def:textfilecontent54_state>

  <lin-def:partition_state id="oval:org.gentoo.dev.swift:ste:7"
    version="1" comment="The file system is mounted with quota support option">
    <lin-def:mount_options entity_check="at least one" operation="pattern match">(usr|grp)quota</lin-def:mount_options>
  </lin-def:partition_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:8"
    version="1" comment="Matching pam">
    <ind-def:text datatype="string" operation="pattern match" entity_check="all">( |")pam( |")</ind-def:text>
  </ind-def:textfilecontent54_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:9"
    version="1" comment="Matching tcpd">
    <ind-def:text datatype="string" operation="pattern match" entity_check="all">( |")tcpd( |")</ind-def:text>
  </ind-def:textfilecontent54_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:10"
    version="1" comment="Matching ssl">
    <ind-def:text datatype="string" operation="pattern match" entity_check="all">( |")ssl( |")</ind-def:text>
  </ind-def:textfilecontent54_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:11"
    version="1" comment="Matching webrsync-gpg">
    <ind-def:text datatype="string" operation="pattern match" entity_check="all">( |")webrsync-gpg( |")</ind-def:text>
  </ind-def:textfilecontent54_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:12"
    version="1" comment="Has a non-empty value">
    <ind-def:subexpression datatype="string" operation="pattern match" entity_check="all">[\S]+</ind-def:subexpression>
  </ind-def:textfilecontent54_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:13"
    version="1" comment="Matches console or tty[0-9]">
    <ind-def:text datatype="string" operation="pattern match" entity_check="all">(console|tty[[:digit:]]+)</ind-def:text>
  </ind-def:textfilecontent54_state>

  <lin-def:partition_state id="oval:org.gentoo.dev.swift:ste:14"
    version="1" comment="hidepid=1 or hidepid=2 mount option">
    <lin-def:mount_options entity_check="at least one" operation="pattern match">hidepid=[12]</lin-def:mount_options>
  </lin-def:partition_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:15"
    version="1" comment="Has a password --md5 entry">
    <ind-def:subexpression datatype="string" operation="pattern match" entity_check="all">[\s]*password --md5 [\S]+</ind-def:subexpression>
  </ind-def:textfilecontent54_state>

  <ind-def:textfilecontent54_state id="oval:org.gentoo.dev.swift:ste:16"
    version="1" comment="Has a password=... entry">
    <ind-def:subexpression datatype="string" operation="pattern match" entity_check="all">[\s]*password=[\S]+</ind-def:subexpression>
  </ind-def:textfilecontent54_state>

  <unix-def:file_state id="oval:org.gentoo.dev.swift:ste:17"
    version="1" comment="The sticky bit is set">
    <unix-def:sticky datatype="boolean">1</unix-def:sticky>
  </unix-def:file_state>

  <unix-def:file_state id="oval:org.gentoo.dev.swift:ste:18"
    version="1" comment="Not world writable">
    <unix-def:owrite datatype="boolean">0</unix-def:owrite>
  </unix-def:file_state>

</states>

<variables>

  <constant_variable id="oval:org.gentoo.dev.swift:var:1" version="1" datatype="string" comment="Path to Portage make.conf">
    <value>/etc/portage/make.conf</value>
  </constant_variable>

</variables>

</oval_definitions>