{{{ oval_metadata("Audit rules that detect changes to the system's mandatory access controls (SELinux) in usr/share/selinux are enabled.") }}}

{{%- if product in ["sle15"] -%}} {{%- endif -%}}

{{%- if product in ["sle15"] -%}} {{{ oval_test_package_installed(package="selinux-policy-devel", evr="", test_id="check_selinux_policy_devel_installed") }}} {{{ oval_test_package_installed(package="selinux-policy-targeted", evr="", test_id="check_selinux_policy_targeted_installed") }}} {{%- endif -%}}

^/etc/audit/rules\.d/.*\.rules$
^\-w[\s]+/usr/share/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$
1
/etc/audit/audit.rules
^\-w[\s]+/usr/share/selinux/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$
1