<def-group>
  <definition class="compliance" id="grub2_password" version="1">
    {{{ oval_metadata("The grub2 boot loader should have password protection enabled.", rule_title=rule_title) }}}

    <criteria operator="OR">
      {{% if product in ["ol7", "ol8", "ol9", "rhel8"] %}}
      <criterion comment="make sure a password is defined in {{{ grub2_boot_path }}}/user.cfg" test_ref="test_grub2_password_usercfg" />
      {{% else %}}
      <criteria operator="AND">
        <criteria comment="check both files to account for procedure change in documentation" operator="OR">
          <criterion comment="make sure a password is defined in {{{ grub2_boot_path }}}/user.cfg" test_ref="test_grub2_password_usercfg" />
          <criterion comment="make sure a password is defined in {{{ grub2_boot_path }}}/grub.cfg" test_ref="test_grub2_password_grubcfg" />
        </criteria>
        <criterion comment="make sure a superuser is defined in {{{ grub2_boot_path }}}/grub.cfg" test_ref="test_bootloader_superuser"/>
      </criteria>
      {{% endif %}}
    </criteria>
  </definition>

  {{% if product not in ["ol7", "ol8", "ol9", "rhel8"] %}}
  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser is defined in {{{ grub2_boot_path }}}/grub.cfg files." id="test_bootloader_superuser" version="2">
    <ind:object object_ref="object_bootloader_superuser" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_bootloader_superuser" version="2">
    <ind:filepath>{{{ grub2_boot_path }}}/grub.cfg</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*set[\s]+superusers=("?)[a-zA-Z_]+\1$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  {{% endif %}}

  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in {{{ grub2_boot_path }}}/user.cfg" id="test_grub2_password_usercfg" version="1">
    <ind:object object_ref="object_grub2_password_usercfg" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_grub2_password_usercfg" version="1">
    <ind:filepath>{{{ grub2_boot_path }}}/user.cfg</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*GRUB2_PASSWORD=grub\.pbkdf2\.sha512.*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  {{% if product not in ["ol7", "ol8", "ol9", "rhel8"] %}}
  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="make sure a password is defined in {{{ grub2_boot_path }}}/grub.cfg" id="test_grub2_password_grubcfg" version="1">
    <ind:object object_ref="object_grub2_password_grubcfg" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_grub2_password_grubcfg" version="1">
    <ind:filepath>{{{ grub2_boot_path }}}/grub.cfg</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*password_pbkdf2[\s]+.*[\s]+grub\.pbkdf2\.sha512.*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  {{% endif %}}
</def-group>
