<?xml version="1.0" encoding="UTF-8"?>

<ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:cat="urn:oasis:names:tc:entity:xmlns:xml:catalog" id="scap_org.open-scap_collection_from_xccdf_ssg-ubuntu1604-xccdf-1.2.xml" schematron-version="1.2">

<ds:data-stream id="scap_org.open-scap_datastream_from_xccdf_ssg-ubuntu1604-xccdf-1.2.xml" scap-version="1.2" use-case="OTHER">

<ds:dictionaries>

<ds:component-ref id="scap_org.open-scap_cref_ssg-ubuntu1604-cpe-dictionary.xml" xlink:href="#scap_org.open-scap_comp_ssg-ubuntu1604-cpe-dictionary.xml">

<cat:catalog>

<cat:uri name="ssg-ubuntu1604-cpe-oval.xml" uri="#scap_org.open-scap_cref_ssg-ubuntu1604-cpe-oval.xml"/>

</cat:catalog>

</ds:component-ref>

</ds:dictionaries>

<ds:checklists>

<ds:component-ref id="scap_org.open-scap_cref_ssg-ubuntu1604-xccdf-1.2.xml" xlink:href="#scap_org.open-scap_comp_ssg-ubuntu1604-xccdf-1.2.xml">

<cat:catalog>

<cat:uri name="ssg-ubuntu1604-oval.xml" uri="#scap_org.open-scap_cref_ssg-ubuntu1604-oval.xml"/>

<cat:uri name="ssg-ubuntu1604-ocil.xml" uri="#scap_org.open-scap_cref_ssg-ubuntu1604-ocil.xml"/>

</cat:catalog>

</ds:component-ref>

</ds:checklists>

<ds:checks>

<ds:component-ref id="scap_org.open-scap_cref_ssg-ubuntu1604-oval.xml" xlink:href="#scap_org.open-scap_comp_ssg-ubuntu1604-oval.xml"/>

<ds:component-ref id="scap_org.open-scap_cref_ssg-ubuntu1604-ocil.xml" xlink:href="#scap_org.open-scap_comp_ssg-ubuntu1604-ocil.xml"/>

<ds:component-ref id="scap_org.open-scap_cref_ssg-ubuntu1604-cpe-oval.xml" xlink:href="#scap_org.open-scap_comp_ssg-ubuntu1604-cpe-oval.xml"/>

</ds:checks>

</ds:data-stream>

<ds:component id="scap_org.open-scap_comp_ssg-ubuntu1604-oval.xml" timestamp="2017-08-29T16:27:32">

<ns0:oval_definitions xmlns:ns0="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:ns2="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:ns3="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:ns4="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:ns5="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">

<ns0:generator>

<ns2:product_name>combine-ovals.py from SCAP Security Guide</ns2:product_name>

<ns2:product_version>ssg: 0.1.35, python: 2.7.13</ns2:product_version>

<ns2:schema_version>5.11</ns2:schema_version>

<ns2:timestamp>2017-08-29T14:27:23</ns2:timestamp>

</ns0:generator>

<ns0:definitions>

<ns0:definition class="compliance" id="oval:ssg-rsyslog_files_groupownership:def:1" version="1">

<ns0:metadata>

<ns0:title>Confirm Existence and Permissions of System Log Files</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>All syslog log files should be owned by the appropriate group.</ns0:description>

<reference ref_id="rsyslog_files_groupownership" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="rsyslog daemon is used as local logging daemon" definition_ref="oval:ssg-package_rsyslog_installed:def:1"/>

<ns0:criterion comment="Check if all system log files are owned by root group" test_ref="oval:ssg-test_rsyslog_files_groupownership:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-rsyslog_files_permissions:def:1" version="1">

<ns0:metadata>

<ns0:title>Confirm Existence and Permissions of System Log Files</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>File permissions for all syslog log files should be set correctly.</ns0:description>

<reference ref_id="rsyslog_files_permissions" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="rsyslog daemon is used as local logging daemon" definition_ref="oval:ssg-package_rsyslog_installed:def:1"/>

<ns0:criterion comment="Check permissions of all system log files" test_ref="oval:ssg-test_rsyslog_files_permissions:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-rsyslog_files_ownership:def:1" version="1">

<ns0:metadata>

<ns0:title>Confirm Existence and Permissions of System Log Files</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1404</ns0:platform>

<ns0:platform>Ubuntu 1604</ns0:platform>

<ns0:platform>Debian 8</ns0:platform>

<ns0:platform>Fedora 23</ns0:platform>

<ns0:platform>Fedora 24</ns0:platform>

<ns0:platform>Red Hat Enterprise Linux 7</ns0:platform>

<ns0:platform>Red Hat Enterprise Linux 6</ns0:platform>

</ns0:affected>

<ns0:description>All syslog log files should be owned by the appropriate user.</ns0:description>

<reference ref_id="rsyslog_files_ownership" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="Check if all system log files are owned by root user" test_ref="oval:ssg-test_rsyslog_files_ownership:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-grub2_enable_iommu_force:def:1" version="1">

<ns0:metadata>

<ns0:title>Force IOMMU usage in GRUB2</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1404</ns0:platform>

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>Look for argument iommu=force in the kernel line in /etc/default/grub.</ns0:description>

<reference ref_id="grub2_enable_iommu_force" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="check for GRUB_CMDLINE_LINUX_DEFAULT exists in /etc/default/grub" test_ref="oval:ssg-test_grub2_default_exists:tst:1"/>

<ns0:criteria operator="OR">

<ns0:criterion comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX_DEFAULT" test_ref="oval:ssg-test_grub2_enable_force_iommu_default:tst:1"/>

<ns0:criterion comment="check for iommu=force in /etc/default/grub via GRUB_CMDLINE_LINUX" test_ref="oval:ssg-test_grub2_enable_force_iommu:tst:1"/>

</ns0:criteria>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="inventory" id="oval:ssg-installed_OS_is_ubuntu1604:def:1" version="1">

<ns0:metadata>

<ns0:title>Ubuntu 1604</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1404</ns0:platform>

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:reference ref_id="cpe:/o:canonical:ubuntu_linux:16.04" source="CPE"/>

<ns0:description>The operating system installed on the system is Ubuntu 1604</ns0:description>

<reference ref_id="installed_OS_is_ubuntu1604" source="ssg"/>

</ns0:metadata>

<ns0:criteria comment="current Ubuntu version is Xenial" operator="AND">

<ns0:extend_definition comment="Installed OS is part of the Unix family" definition_ref="oval:ssg-installed_OS_is_part_of_Unix_family:def:1"/>

<ns0:criterion comment="lsb-based distrib" test_ref="oval:ssg-test_lsb:tst:1"/>

<ns0:criterion comment="Ubuntu is installed" test_ref="oval:ssg-test_ubuntu:tst:1"/>

<ns0:criterion comment="Xenial is installed" test_ref="oval:ssg-test_ubuntu_xenial:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_home:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /home Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>If user home directories will be stored locally, create a

separate partition for /home. If /home will be mounted from another

system such as an NFS server, then creating a separate partition is not

necessary at this time, and the mountpoint can instead be configured

later.</ns0:description>

<reference ref_id="partition_for_home" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/home on own partition" test_ref="oval:ssg-test_home_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_srv:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /srv Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>If a file server (FTP, TFTP...) is hosted locally, create a separate partition

for /srv at installation time (or migrate it later using LVM). If

/srv will be mounted from another system such as an NFS server, then

creating a separate partition is not necessary at installation time, and the

mountpoint can instead be configured later.</ns0:description>

<reference ref_id="partition_for_srv" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/srv on own partition" test_ref="oval:ssg-test_srv_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_tmp:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /tmp Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The /tmp directory is a world-writable directory used for

temporary file storage. Verify that it has its own partition or logical

volume.</ns0:description>

<reference ref_id="partition_for_tmp" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/tmp on own partition" test_ref="oval:ssg-test_tmp_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_var:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /var Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>Ensuring that /var is mounted on its own partition enables

the setting of more restrictive mount options, which is used as temporary

storage by many program, particularly system services such as daemons. It

is not uncommon for the /var directory to contain world-writable

directories, installed by other software packages.</ns0:description>

<reference ref_id="partition_for_var" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/var on own partition" test_ref="oval:ssg-test_var_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_var_log:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /var/log Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>System logs are stored in the /var/log directory. Ensure

that it has its own partition or logical volume.</ns0:description>

<reference ref_id="partition_for_var_log" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/var/log on own partition" test_ref="oval:ssg-test_var_log_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-partition_for_var_log_audit:def:1" version="1">

<ns0:metadata>

<ns0:title>Ensure /var/log/audit Located On Separate Partition</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>Audit logs are stored in the /var/log/audit directory.

Ensure that it has its own partition or logical volume. Make absolutely

certain that it is large enough to store all audit logs that will be

created by the auditing daemon.</ns0:description>

<reference ref_id="partition_for_var_log_audit" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="/var/log/audit on own partition" test_ref="oval:ssg-test_var_log_audit_partition:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-file_permissions_boot_system_map:def:1" version="1">

<ns0:metadata>

<ns0:title>Verify /boot/^System\.map.*$ Permissions</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>This test makes sure that /boot/^System\.map.*$ is owned by 0, group owned by 0, and has mode 0600. If

the target file or directory has an extended ACL then it will fail the mode check.</ns0:description>

<reference ref_id="file_permissions_boot_system_map" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion test_ref="oval:ssg-test_boot_system_map:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-file_permissions_etc_group:def:1" version="1">

<ns0:metadata>

<ns0:title>Verify /etc/group Permissions</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>This test makes sure that /etc/group is owned by 0, group owned by 0, and has mode 0644. If

the target file or directory has an extended ACL then it will fail the mode check.</ns0:description>

<reference ref_id="file_permissions_etc_group" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion test_ref="oval:ssg-test_etc_group:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-file_permissions_etc_gshadow:def:1" version="1">

<ns0:metadata>

<ns0:title>Verify /etc/gshadow Permissions</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>This test makes sure that /etc/gshadow is owned by 0, group owned by 42, and has mode 0640. If

the target file or directory has an extended ACL then it will fail the mode check.</ns0:description>

<reference ref_id="file_permissions_etc_gshadow" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion test_ref="oval:ssg-test_etc_gshadow:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-file_permissions_etc_passwd:def:1" version="1">

<ns0:metadata>

<ns0:title>Verify /etc/passwd Permissions</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>This test makes sure that /etc/passwd is owned by 0, group owned by 0, and has mode 0644. If

the target file or directory has an extended ACL then it will fail the mode check.</ns0:description>

<reference ref_id="file_permissions_etc_passwd" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion test_ref="oval:ssg-test_etc_passwd:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-file_permissions_etc_shadow:def:1" version="1">

<ns0:metadata>

<ns0:title>Verify /etc/shadow Permissions</ns0:title>

<ns0:affected family="unix">

</ns0:affected>

<ns0:description>This test makes sure that /etc/shadow is owned by 0, group owned by 42, and has mode 0640. If

the target file or directory has an extended ACL then it will fail the mode check.</ns0:description>

<reference ref_id="file_permissions_etc_shadow" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion test_ref="oval:ssg-test_etc_shadow:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_auditd_installed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package auditd Installed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package auditd should be installed.</ns0:description>

<reference ref_id="package_auditd_installed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package auditd is installed" test_ref="oval:ssg-test_package_auditd_installed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_cron_installed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package cron Installed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package cron should be installed.</ns0:description>

<reference ref_id="package_cron_installed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package cron is installed" test_ref="oval:ssg-test_package_cron_installed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_inetutils-telnetd_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package inetutils-telnetd Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package inetutils-telnetd should be removed.</ns0:description>

<reference ref_id="package_inetutils-telnetd_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package inetutils-telnetd is removed" test_ref="oval:ssg-test_package_inetutils-telnetd_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_nis_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package nis Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package nis should be removed.</ns0:description>

<reference ref_id="package_nis_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package nis is removed" test_ref="oval:ssg-test_package_nis_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_ntp_installed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package ntp Installed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package ntp should be installed.</ns0:description>

<reference ref_id="package_ntp_installed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package ntp is installed" test_ref="oval:ssg-test_package_ntp_installed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_ntpdate_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package ntpdate Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package ntpdate should be removed.</ns0:description>

<reference ref_id="package_ntpdate_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package ntpdate is removed" test_ref="oval:ssg-test_package_ntpdate_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_openssh-server_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package openssh-server Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package openssh-server should be removed.</ns0:description>

<reference ref_id="package_openssh-server_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package openssh-server is removed" test_ref="oval:ssg-test_package_openssh-server_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_rsyslog_installed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package rsyslog Installed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package rsyslog should be installed.</ns0:description>

<reference ref_id="package_rsyslog_installed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package rsyslog is installed" test_ref="oval:ssg-test_package_rsyslog_installed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_syslog-ng_installed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package syslog-ng Installed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package syslog-ng should be installed.</ns0:description>

<reference ref_id="package_syslog-ng_installed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package syslog-ng is installed" test_ref="oval:ssg-test_package_syslog-ng_installed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_telnetd-ssl_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package telnetd-ssl Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package telnetd-ssl should be removed.</ns0:description>

<reference ref_id="package_telnetd-ssl_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package telnetd-ssl is removed" test_ref="oval:ssg-test_package_telnetd-ssl_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-package_telnetd_removed:def:1" version="1">

<ns0:metadata>

<ns0:title>Package telnetd Removed</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The DEB package telnetd should be removed.</ns0:description>

<reference ref_id="package_telnetd_removed" source="ssg"/>

</ns0:metadata>

<ns0:criteria>

<ns0:criterion comment="package telnetd is removed" test_ref="oval:ssg-test_package_telnetd_removed:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-service_auditd_enabled:def:1" version="1">

<ns0:metadata>

<ns0:title>Service auditd Enabled</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The auditd service should be enabled if possible.</ns0:description>

<reference ref_id="service_auditd_enabled" source="ssg"/>

</ns0:metadata>

<ns0:criteria comment="package auditd installed and service auditd is configured to start" operator="AND">

<ns0:extend_definition comment="auditd installed" definition_ref="oval:ssg-package_auditd_installed:def:1"/>

<ns0:criteria comment="service auditd is configured to start" operator="OR">

<ns0:criterion comment="multi-user.target wants auditd" test_ref="oval:ssg-test_multi_user_wants_auditd:tst:1"/>

</ns0:criteria>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-service_cron_enabled:def:1" version="1">

<ns0:metadata>

<ns0:title>Service cron Enabled</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The cron service should be enabled if possible.</ns0:description>

<reference ref_id="service_cron_enabled" source="ssg"/>

</ns0:metadata>

<ns0:criteria comment="package cron installed and service cron is configured to start" operator="AND">

<ns0:extend_definition comment="cron installed" definition_ref="oval:ssg-package_cron_installed:def:1"/>

<ns0:criteria comment="service cron is configured to start" operator="OR">

<ns0:criterion comment="multi-user.target wants cron" test_ref="oval:ssg-test_multi_user_wants_cron:tst:1"/>

</ns0:criteria>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-service_ntpd_enabled:def:1" version="1">

<ns0:metadata>

<ns0:title>Service ntpd Enabled</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The ntpd service should be enabled if possible.</ns0:description>

<reference ref_id="service_ntpd_enabled" source="ssg"/>

</ns0:metadata>

<ns0:criteria comment="package ntp installed and service ntpd is configured to start" operator="AND">

<ns0:extend_definition comment="ntp installed" definition_ref="oval:ssg-package_ntp_installed:def:1"/>

<ns0:criteria comment="service ntpd is configured to start" operator="OR">

<ns0:criterion comment="multi-user.target wants ntpd" test_ref="oval:ssg-test_multi_user_wants_ntpd:tst:1"/>

</ns0:criteria>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-service_rsyslog_enabled:def:1" version="1">

<ns0:metadata>

<ns0:title>Service rsyslog Enabled</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The rsyslog service should be enabled if possible.</ns0:description>

<reference ref_id="service_rsyslog_enabled" source="ssg"/>

</ns0:metadata>

<ns0:criteria comment="package rsyslog installed and service rsyslog is configured to start" operator="AND">

<ns0:extend_definition comment="rsyslog installed" definition_ref="oval:ssg-package_rsyslog_installed:def:1"/>

<ns0:criteria comment="service rsyslog is configured to start" operator="OR">

<ns0:criterion comment="multi-user.target wants rsyslog" test_ref="oval:ssg-test_multi_user_wants_rsyslog:tst:1"/>

</ns0:criteria>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-service_sshd_disabled:def:1" version="1">

<ns0:metadata>

<ns0:title>Service sshd Disabled</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The sshd service should be disabled if possible.</ns0:description>

<reference ref_id="service_sshd_disabled" source="ssg"/>

</ns0:metadata>

<ns0:criteria comment="package openssh-server removed or service sshd is not configured to start" operator="OR">

<ns0:extend_definition comment="openssh-server removed" definition_ref="oval:ssg-package_openssh-server_removed:def:1"/>

<ns0:criteria comment="service sshd is not configured to start" operator="OR">

<ns0:criterion comment="sshd not wanted by multi-user.target" test_ref="oval:ssg-test_sshd_not_wanted_by_multi_user_target:tst:1"/>

</ns0:criteria>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_fs_protected_hardlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_hardlinks" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "fs.protected_hardlinks" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_fs_protected_hardlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="fs.protected_hardlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1"/>

<ns0:extend_definition comment="fs.protected_hardlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_fs_protected_symlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_symlinks" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "fs.protected_symlinks" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_fs_protected_symlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="fs.protected_symlinks configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_protected_symlinks:def:1"/>

<ns0:extend_definition comment="fs.protected_symlinks runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_fs_suid_dumpable:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.suid_dumpable" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "fs.suid_dumpable" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_fs_suid_dumpable" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="fs.suid_dumpable configuration setting check" definition_ref="oval:ssg-sysctl_static_fs_suid_dumpable:def:1"/>

<ns0:extend_definition comment="fs.suid_dumpable runtime setting check" definition_ref="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_dmesg_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.dmesg_restrict" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.dmesg_restrict" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_dmesg_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.dmesg_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1"/>

<ns0:extend_definition comment="kernel.dmesg_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_kptr_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.kptr_restrict" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.kptr_restrict" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_kptr_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.kptr_restrict configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1"/>

<ns0:extend_definition comment="kernel.kptr_restrict runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_cpu_time_max_percent:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.perf_cpu_time_max_percent" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_perf_cpu_time_max_percent" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.perf_cpu_time_max_percent configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1"/>

<ns0:extend_definition comment="kernel.perf_cpu_time_max_percent runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_max_sample_rate:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_max_sample_rate" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.perf_event_max_sample_rate" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_perf_event_max_sample_rate" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.perf_event_max_sample_rate configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1"/>

<ns0:extend_definition comment="kernel.perf_event_max_sample_rate runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_perf_event_paranoid:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_paranoid" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.perf_event_paranoid" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_perf_event_paranoid" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.perf_event_paranoid configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1"/>

<ns0:extend_definition comment="kernel.perf_event_paranoid runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_pid_max:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.pid_max" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.pid_max" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_pid_max" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.pid_max configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_pid_max:def:1"/>

<ns0:extend_definition comment="kernel.pid_max runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_pid_max:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_randomize_va_space:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.randomize_va_space" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.randomize_va_space" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_randomize_va_space" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.randomize_va_space configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1"/>

<ns0:extend_definition comment="kernel.randomize_va_space runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_kernel_sysrq:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.sysrq" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "kernel.sysrq" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_kernel_sysrq" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="kernel.sysrq configuration setting check" definition_ref="oval:ssg-sysctl_static_kernel_sysrq:def:1"/>

<ns0:extend_definition comment="kernel.sysrq runtime setting check" definition_ref="oval:ssg-sysctl_runtime_kernel_sysrq:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_net_ipv4_ip_forward:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "net.ipv4.ip_forward" Parameter Configuration and Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The "net.ipv4.ip_forward" kernel parameter should be set to the appropriate value in both system configuration and system runtime.</ns0:description>

<reference ref_id="sysctl_net_ipv4_ip_forward" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:extend_definition comment="net.ipv4.ip_forward configuration setting check" definition_ref="oval:ssg-sysctl_static_net_ipv4_ip_forward:def:1"/>

<ns0:extend_definition comment="net.ipv4.ip_forward runtime setting check" definition_ref="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_hardlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_hardlinks" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.protected_hardlinks" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_fs_protected_hardlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter fs.protected_hardlinks set to 1" test_ref="oval:ssg-test_runtime_sysctl_fs_protected_hardlinks:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_protected_symlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_symlinks" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.protected_symlinks" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_fs_protected_symlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter fs.protected_symlinks set to 1" test_ref="oval:ssg-test_runtime_sysctl_fs_protected_symlinks:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_fs_suid_dumpable:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.suid_dumpable" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.suid_dumpable" parameter should be set to "0" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_fs_suid_dumpable" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter fs.suid_dumpable set to 0" test_ref="oval:ssg-test_runtime_sysctl_fs_suid_dumpable:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_dmesg_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.dmesg_restrict" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_dmesg_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.dmesg_restrict set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_dmesg_restrict:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_kptr_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.kptr_restrict" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.kptr_restrict" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_kptr_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.kptr_restrict set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_kptr_restrict:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_cpu_time_max_percent:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_cpu_time_max_percent" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_perf_cpu_time_max_percent" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.perf_cpu_time_max_percent set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_cpu_time_max_percent:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_max_sample_rate:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_max_sample_rate" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_event_max_sample_rate" parameter should be set to "1" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_perf_event_max_sample_rate" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.perf_event_max_sample_rate set to 1" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_event_max_sample_rate:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_perf_event_paranoid:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_paranoid" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_event_paranoid" parameter should be set to "2" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_perf_event_paranoid" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.perf_event_paranoid set to 2" test_ref="oval:ssg-test_runtime_sysctl_kernel_perf_event_paranoid:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_pid_max:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.pid_max" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.pid_max" parameter should be set to "65536" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_pid_max" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.pid_max set to 65536" test_ref="oval:ssg-test_runtime_sysctl_kernel_pid_max:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_randomize_va_space:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.randomize_va_space" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_randomize_va_space" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.randomize_va_space set to 2" test_ref="oval:ssg-test_runtime_sysctl_kernel_randomize_va_space:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_kernel_sysrq:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.sysrq" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.sysrq" parameter should be set to "0" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_kernel_sysrq" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter kernel.sysrq set to 0" test_ref="oval:ssg-test_runtime_sysctl_kernel_sysrq:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_net_ipv4_ip_forward:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "net.ipv4.ip_forward" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "net.ipv4.ip_forward" parameter should be set to the appropriate value in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_net_ipv4_ip_forward" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter net.ipv4.ip_forward set to the appropriate value" test_ref="oval:ssg-test_runtime_sysctl_net_ipv4_ip_forward:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_runtime_vm_mmap_min_addr:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "vm.mmap_min_addr" Parameter Runtime Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "vm.mmap_min_addr" parameter should be set to "65536" in system runtime.</ns0:description>

<reference ref_id="sysctl_runtime_vm_mmap_min_addr" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="AND">

<ns0:criterion comment="kernel runtime parameter vm.mmap_min_addr set to 65536" test_ref="oval:ssg-test_runtime_sysctl_vm_mmap_min_addr:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_hardlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_hardlinks" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.protected_hardlinks" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_fs_protected_hardlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_hardlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_hardlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_hardlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_hardlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_hardlinks:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_fs_protected_symlinks:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.protected_symlinks" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.protected_symlinks" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_fs_protected_symlinks" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_protected_symlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_protected_symlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_protected_symlinks:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.protected_symlinks set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_protected_symlinks:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_fs_suid_dumpable:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "fs.suid_dumpable" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "fs.suid_dumpable" parameter should be set to "0" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_fs_suid_dumpable" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_fs_suid_dumpable:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_fs_suid_dumpable:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_fs_suid_dumpable:tst:1"/>

<ns0:criterion comment="kernel static parameter fs.suid_dumpable set to 0 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_fs_suid_dumpable:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_dmesg_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.dmesg_restrict" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.dmesg_restrict" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_dmesg_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_dmesg_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_dmesg_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_dmesg_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.dmesg_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_dmesg_restrict:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_kptr_restrict:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.kptr_restrict" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.kptr_restrict" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_kptr_restrict" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_kptr_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_kptr_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_kptr_restrict:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.kptr_restrict set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_kptr_restrict:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_cpu_time_max_percent:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_cpu_time_max_percent" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_cpu_time_max_percent" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_perf_cpu_time_max_percent" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_cpu_time_max_percent:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_cpu_time_max_percent set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_cpu_time_max_percent:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_max_sample_rate:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_max_sample_rate" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_event_max_sample_rate" parameter should be set to "1" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_perf_event_max_sample_rate" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_max_sample_rate:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_event_max_sample_rate set to 1 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_max_sample_rate:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_perf_event_paranoid:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.perf_event_paranoid" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.perf_event_paranoid" parameter should be set to "2" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_perf_event_paranoid" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_perf_event_paranoid:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_perf_event_paranoid:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_perf_event_paranoid:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.perf_event_paranoid set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_perf_event_paranoid:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_pid_max:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.pid_max" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.pid_max" parameter should be set to "65536" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_pid_max" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_pid_max:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_pid_max:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_pid_max:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.pid_max set to 65536 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_pid_max:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_randomize_va_space:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.randomize_va_space" Parameter Configuration Check</ns0:title>

<ns0:affected family="unix">

<ns0:platform>Ubuntu 1604</ns0:platform>

</ns0:affected>

<ns0:description>The kernel "kernel.randomize_va_space" parameter should be set to "2" in the system configuration.</ns0:description>

<reference ref_id="sysctl_static_kernel_randomize_va_space" source="ssg"/>

</ns0:metadata>

<ns0:criteria operator="OR">

<ns0:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.conf" test_ref="oval:ssg-test_static_sysctl_kernel_randomize_va_space:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /etc/sysctl.d/*.conf" test_ref="oval:ssg-test_static_etc_sysctld_kernel_randomize_va_space:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /run/sysctl.d/*.conf" test_ref="oval:ssg-test_static_run_sysctld_kernel_randomize_va_space:tst:1"/>

<ns0:criterion comment="kernel static parameter kernel.randomize_va_space set to 2 in /usr/lib/sysctl.d/*.conf" test_ref="oval:ssg-test_static_usr_lib_sysctld_kernel_randomize_va_space:tst:1"/>

</ns0:criteria>

</ns0:definition>

<ns0:definition class="compliance" id="oval:ssg-sysctl_static_kernel_sysrq:def:1" version="3">

<ns0:metadata>

<ns0:title>Kernel "kernel.sysrq" Parameter Configuration Check</ns0:title>