<def-group>
  <definition class="compliance" id="disable_users_coredumps" version="1">
    {{{ oval_metadata("Core dumps for all users should be disabled", rule_title=rule_title) }}}
    <criteria operator="OR">
      <criterion comment="Are core dumps disabled in /etc/security/limits.d/*" test_ref="test_core_dumps_limits_d" />
      <criteria operator="AND">
      	<criterion comment="Are core dumps configured in /etc/security/limits.d/*" test_ref="test_core_dumps_limits_d_exists" negate="true"/>
        <criterion comment="Are core dumps disabled in /etc/security/limits.conf" test_ref="test_core_dumps_limitsconf" />
      </criteria>
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all"
  comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file"
  id="test_core_dumps_limitsconf" version="1">
    <ind:object object_ref="object_core_dumps_limitsconf" />
    <ind:state state_ref="state_core_dumps_limitsconf" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_state id="state_core_dumps_limitsconf" version="1">
    <ind:subexpression operation="equals">0</ind:subexpression>
  </ind:textfilecontent54_state>
  <ind:textfilecontent54_object id="object_core_dumps_limitsconf" version="1">
    <ind:filepath>/etc/security/limits.conf</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\S]+)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all"
  comment="Tests the value of the ^[\s]*\*[\s]+(hard|-)[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.d directory"
  id="test_core_dumps_limits_d" version="1">
    <ind:object object_ref="object_core_dumps_limits_d" />
    <ind:state state_ref="state_core_dumps_limits_d" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_state id="state_core_dumps_limits_d" version="1">
    <ind:subexpression operation="equals">0</ind:subexpression>
  </ind:textfilecontent54_state>
  <ind:textfilecontent54_object id="object_core_dumps_limits_d" version="1">
    <ind:path>/etc/security/limits.d</ind:path>
    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>  
    <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core[\s]+([\S]+)</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_test check="all"
  comment="Tests for existence of the ^[\s]*\*[\s]+(hard|-)[\s]+core setting in the /etc/security/limits.d directory"
  id="test_core_dumps_limits_d_exists" version="1">
    <ind:object object_ref="object_core_dumps_limits_d_exists" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_core_dumps_limits_d_exists" version="1">
    <ind:path>/etc/security/limits.d</ind:path>
    <ind:filename operation="pattern match">^.*\.conf$</ind:filename>
    <ind:pattern operation="pattern match">^[\s]*\*[\s]+(?:hard|-)[\s]+core</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
