<def-group>
    <definition class="compliance" id="{{{ rule_id }}}" version="1">
        {{{
        oval_metadata("Configure Fapolicy Module to Employ a Deny-all, Permit-by-exception Policy", rule_title=rule_title)
        }}}
        <criteria>
            <criteria operator="OR">
                <criterion comment="fapolicyd employs a deny-all policy in compiled.rules file"
                    test_ref="test_fapolicy_default_deny_policy_with_rulesd"/>
                <criterion comment="fapolicyd employs a deny-all policy fapolicyd.rules file"
                    test_ref="test_fapolicy_default_deny_policy_without_rulesd"/>
            </criteria>
            <criterion comment="fapolicyd is in enforcement mode"
                test_ref="test_fapolicy_default_deny_enforcement"/>
        </criteria>
    </definition>

    <ind:textfilecontent54_test id="test_fapolicy_default_deny_policy_with_rulesd" version="1"
        check_existence="only_one_exists" check="all"
        comment="fapolicyd employs a deny-all policy in compiled.rules file">
        <ind:object object_ref="object_fapolicy_default_deny_policy_compiled_rules"/>
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="object_fapolicy_default_deny_policy_compiled_rules"
        version="1">
        <ind:filepath>/etc/fapolicyd/compiled.rules</ind:filepath>
        <ind:pattern operation="pattern match">^\s*deny\s*perm=any\s*all\s*:\s*all\s*\z</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_test id="test_fapolicy_default_deny_policy_without_rulesd" version="2"
        check_existence="only_one_exists" check="all"
        comment="fapolicyd employs a deny-all policy in fapolicyd.rules file">
        <ind:object object_ref="object_fapolicy_default_deny_policy_fapolicyd_rules"/>
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="object_fapolicy_default_deny_policy_fapolicyd_rules"
        version="2">
        <ind:filepath>/etc/fapolicyd/fapolicyd.rules</ind:filepath>
        <ind:pattern operation="pattern match">^\s*deny\s*perm=any\s*all\s*:\s*all\s*\z</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_test id="test_fapolicy_default_deny_enforcement" version="2"
        check_existence="all_exist" check="all"
        comment="permissive mode is disabled in fapolicyd settings">
        <ind:object object_ref="object_fapolicy_default_deny_permissive_mode" />
        <ind:state state_ref="state_fapolicy_default_deny_permissive_mode_off" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="object_fapolicy_default_deny_permissive_mode" version="2">
        <ind:filepath>/etc/fapolicyd/fapolicyd.conf</ind:filepath>
        <ind:pattern operation="pattern match">^\s*permissive\s*=\s*(\d+)</ind:pattern>
        <ind:instance datatype="int" operation="equals">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_state id="state_fapolicy_default_deny_permissive_mode_off" version="2"
        comment="permissive mode value is set to 0 (off) in fapolicyd settings file">
        <ind:subexpression operation="equals" datatype="int">0</ind:subexpression>
    </ind:textfilecontent54_state>
</def-group>
