<?xml version="1.0" encoding="UTF-8"?>

<ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" id="scap_org.open-scap_collection_from_xccdf_ssg-debian8-xccdf-1.2.xml" schematron-version="1.2">

<ds:data-stream id="scap_org.open-scap_datastream_from_xccdf_ssg-debian8-xccdf-1.2.xml" scap-version="1.2" use-case="OTHER">

<ds:dictionaries>

<ds:component-ref id="scap_org.open-scap_cref_ssg-debian8-cpe-dictionary.xml" xlink:href="#scap_org.open-scap_comp_ssg-debian8-cpe-dictionary.xml">

<cat:catalog>

<cat:uri name="ssg-debian8-cpe-oval.xml" uri="#scap_org.open-scap_cref_ssg-debian8-cpe-oval.xml"/>

</cat:catalog>

</ds:component-ref>

</ds:dictionaries>

<ds:checklists>

<ds:component-ref id="scap_org.open-scap_cref_ssg-debian8-xccdf-1.2.xml" xlink:href="#scap_org.open-scap_comp_ssg-debian8-xccdf-1.2.xml">

<cat:catalog>

<cat:uri name="ssg-debian8-oval.xml" uri="#scap_org.open-scap_cref_ssg-debian8-oval.xml"/>

<cat:uri name="ssg-debian8-ocil.xml" uri="#scap_org.open-scap_cref_ssg-debian8-ocil.xml"/>

</cat:catalog>

</ds:component-ref>

</ds:checklists>

<ds:checks>

<ds:component-ref id="scap_org.open-scap_cref_ssg-debian8-oval.xml" xlink:href="#scap_org.open-scap_comp_ssg-debian8-oval.xml"/>

<ds:component-ref id="scap_org.open-scap_cref_ssg-debian8-ocil.xml" xlink:href="#scap_org.open-scap_comp_ssg-debian8-ocil.xml"/>

<ds:component-ref id="scap_org.open-scap_cref_ssg-debian8-cpe-oval.xml" xlink:href="#scap_org.open-scap_comp_ssg-debian8-cpe-oval.xml"/>

</ds:checks>

</ds:data-stream>

<ds:component id="scap_org.open-scap_comp_ssg-debian8-oval.xml" timestamp="2017-08-29T16:33:23">

<ns0:oval_definitions xmlns:ns0="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:ns2="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ns3="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:ns4="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:ns5="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">

<ns0:generator>

<ns2:product_name>combine-ovals.py from SCAP Security Guide</ns2:product_name>

<ns2:product_version>ssg: 0.1.35, python: 2.7.13</ns2:product_version>

<ns2:schema_version>5.10</ns2:schema_version>

<ns2:timestamp>2017-08-29T14:33:19</ns2:timestamp>

</ns0:generator>

<ns0:definitions>

<ns0:definition class="compliance" id="oval:ssg-file_permissions_systemmap:def:1" version="1">

<ns0:metadata>

<ns0:title>Verify that System.map files are readable only by root</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>

Checks that /boot/System.map-* are only readable by root.

</ns0:description>

<reference ref_id="file_permissions_systemmap" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion test_ref="oval:ssg-test_permissions_systemmap_files:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-grub2_enable_iommu_force:def:1" version="1">

<ns0:metadata>

<ns0:title>Force IOMMU usage in GRUB2</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>Look for argument iommu=force in the kernel line in /etc/default/grub.</ns0:description>

<reference ref_id="grub2_enable_iommu_force" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="check for GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub" test_ref="oval:ssg-test_grub2_default_exists:tst:1"/>

<ns0:criteria operator="OR">

<ns0:criterion comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_enable_force_iommu_default:tst:1"/>

<ns0:criterion comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_enable_force_iommu:tst:1"/>

</ns0:criteria>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="inventory" id="oval:ssg-installed_OS_is_debian8:def:1" version="3">

<ns0:metadata>

<ns0:title>Debian 8</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:reference ref_id="cpe:/o:debian:debian_linux:8" source="CPE"/>

<ns0:description>The operating system installed on the system is Debian 8</ns0:description>

<reference ref_id="installed_OS_is_debian8" source="ssg"/>

</ns0:metadata>

<ns0:criteria comment="current Debian version is Debian jessie" operator="AND">

<ns0:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>

<ns0:criterion comment="Debian is installed" test_ref="oval:ssg-test_debian:tst:1"/>

<ns0:criterion comment="Debian8 is installed" test_ref="oval:ssg-test_debian_8:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_home:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /home Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>If user home directories will be stored locally, create a

separate partition for /home. If /home will be mounted from another

system such as an NFS server, then creating a separate partition is not

necessary at this time, and the mountpoint can instead be configured

later.</ns0:description>

<reference ref_id="partition_for_home" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/home on own partition" test_ref="oval:ssg-test_home_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_srv:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /srv Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>If a file server (FTP, TFTP...) is hosted locally, create a separate partition

for /srv at installation time (or migrate it later using LVM). If

/srv will be mounted from another system such as an NFS server, then

creating a separate partition is not necessary at installation time, and the

mountpoint can instead be configured later.</ns0:description>

<reference ref_id="partition_for_srv" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/srv on own partition" test_ref="oval:ssg-test_srv_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_tmp:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /tmp Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The /tmp directory is a world-writable directory used for

temporary file storage. Verify that it has its own partition or logical

volume.</ns0:description>

<reference ref_id="partition_for_tmp" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/tmp on own partition" test_ref="oval:ssg-test_tmp_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_var:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /var Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>Ensuring that /var is mounted on its own partition enables

the setting of more restrictive mount options, which is used as temporary

storage by many program, particularly system services such as daemons. It

is not uncommon for the /var directory to contain world-writable

directories, installed by other software packages.</ns0:description>

<reference ref_id="partition_for_var" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/var on own partition" test_ref="oval:ssg-test_var_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_var_log:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /var/log Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>System logs are stored in the /var/log directory. Ensure

that it has its own partition or logical volume.</ns0:description>

<reference ref_id="partition_for_var_log" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/var/log on own partition" test_ref="oval:ssg-test_var_log_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_var_log_audit:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /var/log/audit Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>Audit logs are stored in the /var/log/audit directory.

Ensure that it has its own partition or logical volume. Make absolutely

certain that it is large enough to store all audit logs that will be

created by the auditing daemon.</ns0:description>

<reference ref_id="partition_for_var_log_audit" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/var/log/audit on own partition" test_ref="oval:ssg-test_var_log_audit_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-file_permissions_etc_group:def:1" version="1">

<ns0:metadata>

<ns0:title>Verify /etc/group Permissions</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>This test makes sure that /etc/group is owned by 0, group owned by 0, and has mode 0644. If

the target file or directory has an extended ACL then it will fail the mode check.</ns0:description>

<reference ref_id="file_permissions_etc_group" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion test_ref="oval:ssg-test_etc_group:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1">

<ns0:metadata>

<ns0:title>Verify /etc/gshadow Permissions</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>This test makes sure that /etc/gshadow is owned by 0, group owned by 42, and has mode 0640. If

the target file or directory has an extended ACL then it will fail the mode check.</ns0:description>

<reference ref_id="file_permissions_etc_gshadow" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion test_ref="oval:ssg-test_etc_gshadow:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-file_permissions_etc_passwd:def:1" version="1">

<ns0:metadata>

<ns0:title>Verify /etc/passwd Permissions</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>This test makes sure that /etc/passwd is owned by 0, group owned by 0, and has mode 0644. If

the target file or directory has an extended ACL then it will fail the mode check.</ns0:description>

<reference ref_id="file_permissions_etc_passwd" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion test_ref="oval:ssg-test_etc_passwd:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-file_permissions_etc_shadow:def:1" version="1">

<ns0:metadata>

<ns0:title>Verify /etc/shadow Permissions</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>This test makes sure that /etc/shadow is owned by 0, group owned by 42, and has mode 0640. If

the target file or directory has an extended ACL then it will fail the mode check.</ns0:description>

<reference ref_id="file_permissions_etc_shadow" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion test_ref="oval:ssg-test_etc_shadow:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_home_nodev:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nodev Option to /home</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/home should be mounted with mount option nodev.</ns0:description>

<reference ref_id="mount_option_home_nodev" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nodev on /home" test_ref="oval:ssg-test_home_partition_nodev:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_home_nosuid:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nosuid Option to /home</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/home should be mounted with mount option nosuid.</ns0:description>

<reference ref_id="mount_option_home_nosuid" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nosuid on /home" test_ref="oval:ssg-test_home_partition_nosuid:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_tmp_nodev:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nodev Option to /tmp</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/tmp should be mounted with mount option nodev.</ns0:description>

<reference ref_id="mount_option_tmp_nodev" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nodev on /tmp" test_ref="oval:ssg-test_tmp_partition_nodev:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_tmp_nosuid:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nosuid Option to /tmp</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/tmp should be mounted with mount option nosuid.</ns0:description>

<reference ref_id="mount_option_tmp_nosuid" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nosuid on /tmp" test_ref="oval:ssg-test_tmp_partition_nosuid:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_usr_nodev:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nodev Option to /usr</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/usr should be mounted with mount option nodev.</ns0:description>

<reference ref_id="mount_option_usr_nodev" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nodev on /usr" test_ref="oval:ssg-test_usr_partition_nodev:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_var_lib_nodev:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nodev Option to /var/lib</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/var/lib should be mounted with mount option nodev.</ns0:description>

<reference ref_id="mount_option_var_lib_nodev" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nodev on /var/lib" test_ref="oval:ssg-test_var_lib_partition_nodev:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_var_lib_nosuid:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nosuid Option to /var/lib</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/var/lib should be mounted with mount option nosuid.</ns0:description>

<reference ref_id="mount_option_var_lib_nosuid" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nosuid on /var/lib" test_ref="oval:ssg-test_var_lib_partition_nosuid:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_var_log_nodev:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nodev Option to /var/log</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/var/log should be mounted with mount option nodev.</ns0:description>

<reference ref_id="mount_option_var_log_nodev" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nodev on /var/log" test_ref="oval:ssg-test_var_log_partition_nodev:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_var_log_noexec:def:1" version="1">

<ns0:metadata>

<ns0:title>Add noexec Option to /var/log</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/var/log should be mounted with mount option noexec.</ns0:description>

<reference ref_id="mount_option_var_log_noexec" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="noexec on /var/log" test_ref="oval:ssg-test_var_log_partition_noexec:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_var_log_nosuid:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nosuid Option to /var/log</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/var/log should be mounted with mount option nosuid.</ns0:description>

<reference ref_id="mount_option_var_log_nosuid" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nosuid on /var/log" test_ref="oval:ssg-test_var_log_partition_nosuid:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_var_nodev:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nodev Option to /var</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/var should be mounted with mount option nodev.</ns0:description>

<reference ref_id="mount_option_var_nodev" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nodev on /var" test_ref="oval:ssg-test_var_partition_nodev:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_var_noexec:def:1" version="1">

<ns0:metadata>

<ns0:title>Add noexec Option to /var</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/var should be mounted with mount option noexec.</ns0:description>

<reference ref_id="mount_option_var_noexec" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="noexec on /var" test_ref="oval:ssg-test_var_partition_noexec:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-mount_option_var_nosuid:def:1" version="1">

<ns0:metadata>

<ns0:title>Add nosuid Option to /var</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>/var should be mounted with mount option nosuid.</ns0:description>

<reference ref_id="mount_option_var_nosuid" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="nosuid on /var" test_ref="oval:ssg-test_var_partition_nosuid:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_auditd_installed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package auditd Installed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package auditd should be installed.</ns0:description>

<reference ref_id="package_auditd_installed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package auditd is installed" test_ref="oval:ssg-test_package_auditd_installed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_cron_installed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package cron Installed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package cron should be installed.</ns0:description>

<reference ref_id="package_cron_installed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package cron is installed" test_ref="oval:ssg-test_package_cron_installed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_inetutils-telnetd_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package inetutils-telnetd Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package inetutils-telnetd should be removed.</ns0:description>

<reference ref_id="package_inetutils-telnetd_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package inetutils-telnetd is removed" test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_nis_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package nis Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package nis should be removed.</ns0:description>

<reference ref_id="package_nis_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package nis is removed" test_ref="oval:ssg-test_package_nis_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_ntp_installed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package ntp Installed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package ntp should be installed.</ns0:description>

<reference ref_id="package_ntp_installed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package ntp is installed" test_ref="oval:ssg-test_package_ntp_installed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_ntpdate_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package ntpdate Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package ntpdate should be removed.</ns0:description>

<reference ref_id="package_ntpdate_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package ntpdate is removed" test_ref="oval:ssg-test_package_ntpdate_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_openssh-server_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package openssh-server Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package openssh-server should be removed.</ns0:description>

<reference ref_id="package_openssh-server_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package openssh-server is removed" test_ref="oval:ssg-test_package_openssh-server_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_rsyslog_installed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package rsyslog Installed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package rsyslog should be installed.</ns0:description>

<reference ref_id="package_rsyslog_installed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package rsyslog is installed" test_ref="oval:ssg-test_package_rsyslog_installed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_syslog-ng-core_installed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package syslog-ng-core Installed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package syslog-ng-core should be installed.</ns0:description>

<reference ref_id="package_syslog-ng-core_installed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package syslog-ng-core is installed" test_ref="oval:ssg-test_package_syslog-ng-core_installed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_telnetd-ssl_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package telnetd-ssl Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package telnetd-ssl should be removed.</ns0:description>

<reference ref_id="package_telnetd-ssl_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package telnetd-ssl is removed" test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_telnetd_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package telnetd Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package telnetd should be removed.</ns0:description>

<reference ref_id="package_telnetd_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package telnetd is removed" test_ref="oval:ssg-test_package_telnetd_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-service_sshd_disabled:def:1" version="1">

<ns0:metadata>

<ns0:title>Service sshd Disabled</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The sshd service should be disabled if possible.</ns0:description>

<reference ref_id="service_sshd_disabled" source="ssg"/>

</ns0:metadata>

<ns0:criteria comment="package openssh-server removed or service sshd is not configured to start" operator="OR">

<ns0:extend_definition comment="openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>

<ns0:criterion comment="sshd disabled in /etc/rc*.d" test_ref="oval:ssg-test_sshd_disabled:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_hardlinks" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "fs.protected_hardlinks" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_fs_protected_hardlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="fs.protected_hardlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1"/>

<ns0:extend_definition comment="fs.protected_hardlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_fs_protected_symlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_symlinks" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "fs.protected_symlinks" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_fs_protected_symlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="fs.protected_symlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_symlinks:def:1"/>

<ns0:extend_definition comment="fs.protected_symlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.suid_dumpable" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "fs.suid_dumpable" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_fs_suid_dumpable" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="fs.suid_dumpable configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1"/>

<ns0:extend_definition comment="fs.suid_dumpable runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.dmesg_restrict" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.dmesg_restrict" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_dmesg_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.dmesg_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1"/>

<ns0:extend_definition comment="kernel.dmesg_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.kptr_restrict" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.kptr_restrict" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_kptr_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.kptr_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1"/>

<ns0:extend_definition comment="kernel.kptr_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.perf_cpu_time_max_percent" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_perf_cpu_time_max_percent" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.perf_cpu_time_max_percent configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1"/>

<ns0:extend_definition comment="kernel.perf_cpu_time_max_percent runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_max_sample_rate" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.perf_event_max_sample_rate" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_perf_event_max_sample_rate" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.perf_event_max_sample_rate configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1"/>

<ns0:extend_definition comment="kernel.perf_event_max_sample_rate runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_paranoid" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.perf_event_paranoid" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_perf_event_paranoid" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.perf_event_paranoid configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1"/>

<ns0:extend_definition comment="kernel.perf_event_paranoid runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_pid_max:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.pid_max" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.pid_max" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_pid_max" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.pid_max configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_pid_max:def:1"/>

<ns0:extend_definition comment="kernel.pid_max runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_pid_max:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.randomize_va_space" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.randomize_va_space" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_randomize_va_space" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.randomize_va_space configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1"/>

<ns0:extend_definition comment="kernel.randomize_va_space runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_sysrq:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.sysrq" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.sysrq" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_sysrq" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.sysrq configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_sysrq:def:1"/>

<ns0:extend_definition comment="kernel.sysrq runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_sysrq:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "net.ipv4.ip_forward" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The "net.ipv4.ip_forward" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_net_ipv4_ip_forward" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="net.ipv4.ip_forward configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1"/>

<ns0:extend_definition comment="net.ipv4.ip_forward runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_hardlinks" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.protected_hardlinks" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_fs_protected_hardlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter fs.protected_hardlinks set to 1" test_ref="oval:ssg-test_runtime_sysctl_fs_protected_hardlinks:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_symlinks" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.protected_symlinks" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_fs_protected_symlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter fs.protected_symlinks set to 1" test_ref="oval:ssg-test_runtime_sysctl_fs_protected_symlinks:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.suid_dumpable" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.suid_dumpable" parameter should be set to "0" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_fs_suid_dumpable" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="oval:ssg-test_runtime_sysctl_fs_suid_dumpable:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.dmesg_restrict" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_dmesg_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_dmesg_restrict:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.kptr_restrict" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.kptr_restrict" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_kptr_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.kptr_restrict set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_kptr_restrict:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_cpu_time_max_percent" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_perf_cpu_time_max_percent" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_cpu_time_max_percent:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_max_sample_rate" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_event_max_sample_rate" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_perf_event_max_sample_rate" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_event_max_sample_rate:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_paranoid" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_event_paranoid" parameter should be set to "2" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_perf_event_paranoid" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_event_paranoid:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.pid_max" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.pid_max" parameter should be set to "65536" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_pid_max" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.pid_max set to 65536" test_ref="oval:ssg-test_runtime_sysctl_kernel_pid_max:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.randomize_va_space" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_randomize_va_space" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="oval:ssg-test_runtime_sysctl_kernel_randomize_va_space:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.sysrq" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.sysrq" parameter should be set to "0" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_sysrq" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.sysrq set to 0" test_ref="oval:ssg-test_runtime_sysctl_kernel_sysrq:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "net.ipv4.ip_forward" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "net.ipv4.ip_forward" parameter should be set to the appropriate value in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_net_ipv4_ip_forward" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter net.ipv4.ip_forward set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_ip_forward:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "vm.mmap_min_addr" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "vm.mmap_min_addr" parameter should be set to "65536" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_vm_mmap_min_addr" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter vm.mmap_min_addr set to 65536" test_ref="oval:ssg-test_runtime_sysctl_vm_mmap_min_addr:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_hardlinks" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.protected_hardlinks" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_fs_protected_hardlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_symlinks" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.protected_symlinks" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_fs_protected_symlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.suid_dumpable" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.suid_dumpable" parameter should be set to "0" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_fs_suid_dumpable" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.dmesg_restrict" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_dmesg_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.kptr_restrict" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.kptr_restrict" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_kptr_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_cpu_time_max_percent" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_perf_cpu_time_max_percent" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_max_sample_rate" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_event_max_sample_rate" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_perf_event_max_sample_rate" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_paranoid" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Debian 8</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_event_paranoid" parameter should be set to "2" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_perf_event_paranoid" source="ssg"/>

</ns0:metadata>