<def-group>
  <definition class="compliance" id="grub2_disable_interactive_boot" version="4">
    {{{ oval_metadata("The ability for users to perform interactive startups should
      be disabled.", rule_title=rule_title) }}}
    <criteria operator="AND">
      <criterion test_ref="test_grub2_disable_interactive_boot_grub_cmdline_linux"
      comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX" />
      <criteria operator="AND">
        <criterion test_ref="test_grub2_disable_interactive_boot_grub_cmdline_linux_default"
        comment="Check systemd.confirm_spawn=(1|yes|true|on) not in GRUB_CMDLINE_LINUX_DEFAULT" />
        <extend_definition definition_ref="bootloader_disable_recovery_set_to_true"
        comment="Check GRUB_DISABLE_RECOVERY=true in /etc/default/grub" />
      </criteria>
    </criteria>
  </definition>

  <!-- Verify systemd.confirm_spawn=(1|yes|true|on) not present in GRUB_CMDLINE_LINUX
       of /etc/default/grub -->
  <ind:textfilecontent54_test id="test_grub2_disable_interactive_boot_grub_cmdline_linux"
  comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX"
  check="all" check_existence="none_exist" version="1">
    <ind:object object_ref="object_grub2_disable_interactive_boot_grub_cmdline_linux" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_grub2_disable_interactive_boot_grub_cmdline_linux"
  version="1">
    <ind:filepath>/etc/default/grub</ind:filepath>
    <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX="(?:.*\s)?systemd\.confirm_spawn(?:=(?:1|yes|true|on))?(?:\s.*)?"$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <!-- Or verify systemd.confirm_spawn=(1|yes|true|on) not present in GRUB_CMDLINE_LINUX_DEFAULT
       of /etc/default/grub and GRUB_DISABLE_RECOVERY set to "true" -->
  <ind:textfilecontent54_test id="test_grub2_disable_interactive_boot_grub_cmdline_linux_default"
  comment="Check systemd.confirm_spawn=(1|true|yes|on) not in GRUB_CMDLINE_LINUX_DEFAULT"
  check="all" check_existence="none_exist" version="1">
    <ind:object object_ref="object_grub2_disable_interactive_boot_grub_cmdline_linux_default" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_grub2_disable_interactive_boot_grub_cmdline_linux_default"
  version="1">
    <ind:filepath>/etc/default/grub</ind:filepath>
    <ind:pattern operation="pattern match">^\s*GRUB_CMDLINE_LINUX_DEFAULT=".*systemd\.confirm_spawn=(?:1|yes|true|on).*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
