<def-group>
    <definition class="compliance" id="{{{ rule_id }}}" version="1">
        {{{ oval_metadata("SELinux is not Disabled.", rule_title=rule_title) }}}
        <criteria operator="AND">
            <criterion test_ref="test_selinux_not_disabled" comment="SELinux is not disabled"/>
        </criteria>
    </definition>

    <ind:textfilecontent54_test id="test_selinux_not_disabled" version="1"
        check="all" check_existence="all_exist"
        comment="SELinux is not disabled in /etc/selinux/config">
        <ind:object object_ref="object_selinux_not_disabled" />
        <ind:state state_ref="state_selinux_not_disabled" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="object_selinux_not_disabled" version="1">
        <ind:filepath>/etc/selinux/config</ind:filepath>
        <ind:pattern operation="pattern match">^SELINUX=(.*)$</ind:pattern>
        <ind:instance datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_state id="state_selinux_not_disabled" version="1">
        <ind:subexpression datatype="string"
            operation="pattern match">^(enforcing|permissive)$</ind:subexpression>
    </ind:textfilecontent54_state>
</def-group>
