<def-group>
  <definition class="compliance"
  id="audit_rules_time_watch_localtime" version="1">
    <metadata>
      <title>Record Attempts to Alter Time Through the Localtime File</title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 6</platform>
      </affected>
      <description>Record attempts to alter time through /etc/localtime
      </description>
    </metadata>
    <criteria comment="Test for localtime file being watched" >
      <criterion comment="watch localtime file"
      test_ref="test_audit_rules_time_watch_localtime" />
    </criteria>
  </definition>
  <ind:textfilecontent54_test check="all"
  check_existence="at_least_one_exists"
  comment="Tests the for presence etc localtime file in the rules file"
  id="test_audit_rules_time_watch_localtime" version="1">
    <ind:object object_ref="obj_audit_rules_time_watch_localtime" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_audit_rules_time_watch_localtime"
  version="1">
    <ind:filepath>/etc/audit/audit.rules</ind:filepath>
    <ind:pattern 
    operation="pattern match">^[\s]*-w[\s]+\/etc\/localtime[\s]+-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*-k[\s]+[\S]+[\s]*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>
