<def-group>
  <definition class="compliance" id="rpm_verify_hashes" version="2">
    <metadata>
      <title>Verify File Hashes with RPM</title>
      <affected family="unix">
        <platform>CentOS 4</platform>
		<platform>CentOS 5</platform>
		<platform>Red Hat Enterprise Linux 4</platform>
		<platform>Red Hat Enterprise Linux 5</platform>
      </affected>
      <description>Verify the MD5 hashes of system binaries using the RPM database.</description>
    </metadata>
    <criteria>
      <criterion test_ref="test_files_fail_md5_hash" comment="verify file md5 hashes" />
    </criteria>
  </definition>
  <!-- NOTE: If you examine the regex below you notice that I am only interested in files containing -->
  <!-- "bin/" in the path. This essentially narrows our focus down to system executables in directories -->
  <!-- such as /sbin, /usr/bin, and such. After testing I decided that doing it this way was most -->
  <!-- effective at reducing the false positives. If you look at the state below you will notice that I -->
  <!-- commented out several attributes. The current rpmverify object has methods to distinguish between -->
  <!-- configuration files, documentation files, etc. Using these discriminators in the state reduced -->
  <!-- the number of false positives, but it did not eliminate them. I left them commented out to serve -->
  <!-- as an example of what they look like. -->
  <linux:rpmverifyfile_test check_existence="none_exist" id="test_files_fail_md5_hash" version="1" check="all" comment="verify file md5 hashes">
    <linux:object object_ref="object_files_fail_md5_hash"/>
  </linux:rpmverifyfile_test>
  <linux:rpmverifyfile_object id="object_files_fail_md5_hash" version="1" comment="rpm verify of all files">
    <linux:behaviors nomd5="false"/>
    <linux:name operation="pattern match">.*</linux:name>
    <linux:epoch operation="pattern match">.*</linux:epoch>
    <linux:version operation="pattern match">.*</linux:version>
    <linux:release operation="pattern match">.*</linux:release>
    <linux:arch operation="pattern match">.*</linux:arch>
    <linux:filepath operation="pattern match">^.*bin/.*$</linux:filepath>
    <filter action="include">state_files_fail_md5_hash</filter>
  </linux:rpmverifyfile_object>
  <linux:rpmverifyfile_state id="state_files_fail_md5_hash" version="1" operator="AND">
    <linux:md5_differs>fail</linux:md5_differs>
    <!-- <linux:configuration_file datatype="boolean">false</linux:configuration_file> -->
    <!-- <linux:documentation_file datatype="boolean">false</linux:documentation_file> -->
    <!-- <linux:ghost_file datatype="boolean">false</linux:ghost_file> -->
    <!-- <linux:license_file datatype="boolean">false</linux:license_file> -->
    <!-- <linux:readme_file datatype="boolean">false</linux:readme_file> -->
  </linux:rpmverifyfile_state>
</def-group>
