<def-group>

  <definition class="compliance" id="accounts_password_minlen_login_defs" version="3">
    <metadata>
      <title>Set Password Expiration Parameters</title>
      <affected family="unix">
        <platform>multi_platform_all</platform>
      </affected>
      <description>The password minimum length should be set appropriately.</description>
      <reference source="JL" ref_id="RHEL6_20150201" ref_url="test_attestation" />
      <reference source="JL" ref_id="RHEL7_20150201" ref_url="test_attestation" />
      <reference source="JL" ref_id="FEDORA20_20150201" ref_url="test_attestation" />
    </metadata>
    <criteria operator="AND">
      <criterion test_ref="test_pass_min_len" />
    </criteria>
  </definition>

    <ind:variable_test id="test_pass_min_len" check="all" comment="The value of PASS_MIN_LEN should be set appropriately in /etc/login.defs" version="1">
    <ind:object object_ref="object_last_pass_min_len_instance_value" />
    <ind:state state_ref="state_last_pass_min_len_instance_value" />
  </ind:variable_test>

  <ind:textfilecontent54_object id="object_last_pass_min_len_from_etc_login_defs" version="1">
    <!-- Read whole /etc/login.defs as single line so we can retrieve last PASS_MIN_LEN directive occurrence -->
    <ind:behaviors singleline="true" />
    <ind:filepath>/etc/login.defs</ind:filepath>
    <!-- Retrieve last (uncommented) occurrence of PASS_MIN_LEN directive -->
    <ind:pattern operation="pattern match">.*\n[^#]*(PASS_MIN_LEN\s+\d+)\s*\n</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <!-- Capture the actual PASS_MIN_LEN integer value from the previously retrieved last instance -->
  <local_variable id="variable_last_pass_min_len_instance_value" datatype="int" comment="The value of last PASS_MIN_LEN directive in /etc/login.defs" version="1">
    <regex_capture pattern="PASS_MIN_LEN\s+(\d+)">
      <object_component item_field="subexpression" object_ref="object_last_pass_min_len_from_etc_login_defs" />
    </regex_capture>
  </local_variable>

  <!-- Construct OVAL object from this local variable so we can use it in variable test above -->
  <ind:variable_object id="object_last_pass_min_len_instance_value" version="1">
    <ind:var_ref>variable_last_pass_min_len_instance_value</ind:var_ref>
  </ind:variable_object>

  <!-- Define corresponding variable state (the requirement) for the variable object -->
  <!-- The check should PASS if retrieved last PASS_MIN_LEN value is greater than or equal to the requirement -->
  <ind:variable_state id="state_last_pass_min_len_instance_value" version="1">
    <ind:value operation="greater than or equal" var_ref="var_accounts_password_minlen_login_defs" datatype="int" var_check="at least one" />
  </ind:variable_state>

  <external_variable comment="Password minimum length" datatype="int" id="var_accounts_password_minlen_login_defs" version="1" />

</def-group>
