<def-group>
  <definition class="compliance" id="bootloader_audit_argument" version="1">
    <metadata>
      <title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
      <affected family="unix">
        <platform>CentOS 4</platform>
		<platform>CentOS 5</platform>
		<platform>Red Hat Enterprise Linux 4</platform>
		<platform>Red Hat Enterprise Linux 5</platform>
      </affected>
      <description>Look for argument audit=1 in the kernel line in /boot/grub/grub.conf.</description>
    </metadata>
    <criteria>
      <criterion test_ref="test_bootloader_audit_argument" comment="check for audit=1 in /boot/grub/grub.conf" />
    </criteria>
  </definition>
  <ind:textfilecontent54_test check="all" comment="check for audit=1 in /boot/grub/grub.conf"  id="test_bootloader_audit_argument" version="1">
    <ind:object object_ref="object_bootloader_audit_argument" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="object_bootloader_audit_argument" version="1">
    <ind:path>/boot/grub</ind:path>
    <ind:filename>grub.conf</ind:filename>
    <ind:pattern operation="pattern match">^\s*kernel\s+(?:/boot)*/vmlinuz.*audit=1.*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
