<def-group>
  <definition class="inventory" id="selinux_is_enabled" version="1">
    <metadata>
      <title>SELinux status check</title>
      <affected family="unix">
        <platform>multi_platform_all</platform>
      </affected>
      <description>Check if System has SELinux enabled.</description>
      <reference ref_id="cpe:/a:selinux" source="CPE" />
    </metadata>
    <criteria operator="AND">
      <criterion comment="enforce is disabled" test_ref="test_etc_selinux_configured" />
      <criterion comment="/sys/fs/selinux is present" test_ref="test_selinux_sys_fs_exist" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="/selinux/enforce is 1" id="test_etc_selinux_configured" version="1">
    <ind:object object_ref="object_etc_selinux_configured" />
    <ind:state state_ref="state_etc_selinux_configured" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_etc_selinux_configured" version="1">
    <ind:filepath>/etc/selinux/config</ind:filepath>
    <ind:pattern operation="pattern match">^SELINUX=(.*)$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_etc_selinux_configured" version="1">
    <ind:subexpression datatype="string"
      operation="pattern match">^(enforcing|permissive)$</ind:subexpression>
  </ind:textfilecontent54_state>
  <unix:file_test check="all" check_existence="all_exist" comment="check if /sys/fs/selinux exists" id="test_selinux_sys_fs_exist" version="1">
    <unix:object object_ref="object_selinux_sys_fs_exist" />
  </unix:file_test>

  <unix:file_object comment="/sys/fs/selinux" id="object_selinux_sys_fs_exist" version="1">
    <unix:path>/sys/fs/selinux</unix:path>
    <unix:filename xsi:nil="true" />
  </unix:file_object>
</def-group>
