ssg-nondebian 0.1.31-5 / usr / share / scap-security-guide / ssg-rhel7-ocil.xml

<ocil xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://scap.nist.gov/schema/ocil/2.0" xmlns:xhtml="http://www.w3.org/1999/xhtml">
  <generator>
    <schema_version>2.0</schema_version>
    <timestamp>2017-08-11T09:18:08Z</timestamp>
  </generator>
  <questionnaires>
    <questionnaire id="ocil:ssg-partition_for_tmp_ocil:questionnaire:1">
      <title>Ensure /tmp Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_tmp_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-partition_for_var_ocil:questionnaire:1">
      <title>Ensure /var Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_var_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-partition_for_var_log_ocil:questionnaire:1">
      <title>Ensure /var/log Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_var_log_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-partition_for_var_log_audit_ocil:questionnaire:1">
      <title>Ensure /var/log/audit Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_var_log_audit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-partition_for_home_ocil:questionnaire:1">
      <title>Ensure /home Located On Separate Partition</title>
      <actions>
        <test_action_ref>ocil:ssg-partition_for_home_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-encrypt_partitions_ocil:questionnaire:1">
      <title>Encrypt Partitions</title>
      <actions>
        <test_action_ref>ocil:ssg-encrypt_partitions_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ensure_redhat_gpgkey_installed_ocil:questionnaire:1">
      <title>Ensure Red Hat GPG Key Installed</title>
      <actions>
        <test_action_ref>ocil:ssg-ensure_redhat_gpgkey_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1">
      <title>Ensure gpgcheck Enabled In Main Yum Configuration</title>
      <actions>
        <test_action_ref>ocil:ssg-ensure_gpgcheck_globally_activated_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ensure_gpgcheck_never_disabled_ocil:questionnaire:1">
      <title>Ensure gpgcheck Enabled For All Yum Package Repositories</title>
      <actions>
        <test_action_ref>ocil:ssg-ensure_gpgcheck_never_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-security_patches_up_to_date_ocil:questionnaire:1">
      <title>Ensure Software Patches Installed</title>
      <actions>
        <test_action_ref>ocil:ssg-security_patches_up_to_date_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-clean_components_post_updating_ocil:questionnaire:1">
      <title>Ensure YUM Removes Previous Package Versions</title>
      <actions>
        <test_action_ref>ocil:ssg-clean_components_post_updating_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ensure_gpgcheck_local_packages_ocil:questionnaire:1">
      <title>Ensure gpgcheck Enabled for Local Packages</title>
      <actions>
        <test_action_ref>ocil:ssg-ensure_gpgcheck_local_packages_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ensure_gpgcheck_repo_metadata_ocil:questionnaire:1">
      <title>Ensure gpgcheck Enabled for Repository Metadata</title>
      <actions>
        <test_action_ref>ocil:ssg-ensure_gpgcheck_repo_metadata_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_aide_installed_ocil:questionnaire:1">
      <title>Install AIDE</title>
      <actions>
        <test_action_ref>ocil:ssg-package_aide_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-aide_build_database_ocil:questionnaire:1">
      <title>Build and Test AIDE Database</title>
      <actions>
        <test_action_ref>ocil:ssg-aide_build_database_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-aide_periodic_cron_checking_ocil:questionnaire:1">
      <title>Configure Periodic Execution of AIDE</title>
      <actions>
        <test_action_ref>ocil:ssg-aide_periodic_cron_checking_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-aide_scan_notification_ocil:questionnaire:1">
      <title>Configure Notification of Post-AIDE Scan Details</title>
      <actions>
        <test_action_ref>ocil:ssg-aide_scan_notification_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-aide_verify_acls_ocil:questionnaire:1">
      <title>Configure AIDE to Verify Access Control Lists (ACLs)</title>
      <actions>
        <test_action_ref>ocil:ssg-aide_verify_acls_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-aide_verify_ext_attributes_ocil:questionnaire:1">
      <title>Configure AIDE to Verify Extended Attributes</title>
      <actions>
        <test_action_ref>ocil:ssg-aide_verify_ext_attributes_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-aide_use_fips_hashes_ocil:questionnaire:1">
      <title>Configure AIDE to Use FIPS 140-2 for Validating Hashes</title>
      <actions>
        <test_action_ref>ocil:ssg-aide_use_fips_hashes_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rpm_verify_permissions_ocil:questionnaire:1">
      <title>Verify and Correct File Permissions with RPM</title>
      <actions>
        <test_action_ref>ocil:ssg-rpm_verify_permissions_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rpm_verify_hashes_ocil:questionnaire:1">
      <title>Verify File Hashes with RPM</title>
      <actions>
        <test_action_ref>ocil:ssg-rpm_verify_hashes_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-install_hids_ocil:questionnaire:1">
      <title>Install Intrusion Detection Software</title>
      <actions>
        <test_action_ref>ocil:ssg-install_hids_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-install_antivirus_ocil:questionnaire:1">
      <title>Install Virus Scanning Software</title>
      <actions>
        <test_action_ref>ocil:ssg-install_antivirus_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-install_mcafee_cma_rt_ocil:questionnaire:1">
      <title>Install the McAfee Runtime Libraries and Linux Agent</title>
      <actions>
        <test_action_ref>ocil:ssg-install_mcafee_cma_rt_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-install_mcafee_hbss_hips_ocil:questionnaire:1">
      <title>Install the Host Intrusion Prevention System (HIPS) Module</title>
      <actions>
        <test_action_ref>ocil:ssg-install_mcafee_hbss_hips_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-install_mcafee_hbss_accm_ocil:questionnaire:1">
      <title>Install the Asset Configuration Compliance Module (ACCM)</title>
      <actions>
        <test_action_ref>ocil:ssg-install_mcafee_hbss_accm_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-install_mcafee_hbss_pa_ocil:questionnaire:1">
      <title>Install the Policy Auditor (PA) Module</title>
      <actions>
        <test_action_ref>ocil:ssg-install_mcafee_hbss_pa_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-install_mcafee_antivirus_ocil:questionnaire:1">
      <title>Install McAfee Virus Scanning Software</title>
      <actions>
        <test_action_ref>ocil:ssg-install_mcafee_antivirus_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_nails_enabled_ocil:questionnaire:1">
      <title>Enable nails Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_nails_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-mcafee_antivirus_definitions_updated_ocil:questionnaire:1">
      <title>Virus Scanning Software Definitions Are Updated</title>
      <actions>
        <test_action_ref>ocil:ssg-mcafee_antivirus_definitions_updated_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_dracut-fips_installed_ocil:questionnaire:1">
      <title>Install the dracut-fips Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_dracut-fips_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-grub2_enable_fips_mode_ocil:questionnaire:1">
      <title>Enable FIPS Mode in GRUB2</title>
      <actions>
        <test_action_ref>ocil:ssg-grub2_enable_fips_mode_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-installed_OS_is_certified_ocil:questionnaire:1">
      <title>The Installed Operating System Is Vendor Supported and Certified</title>
      <actions>
        <test_action_ref>ocil:ssg-installed_OS_is_certified_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-enable_dconf_user_profile_ocil:questionnaire:1">
      <title>Configure GNOME3 DConf User Profile</title>
      <actions>
        <test_action_ref>ocil:ssg-enable_dconf_user_profile_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-gnome_gdm_disable_automatic_login_ocil:questionnaire:1">
      <title>Disable GDM Automatic Login</title>
      <actions>
        <test_action_ref>ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-gnome_gdm_disable_guest_login_ocil:questionnaire:1">
      <title>Disable GDM Guest Login</title>
      <actions>
        <test_action_ref>ocil:ssg-gnome_gdm_disable_guest_login_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_disable_user_list_ocil:questionnaire:1">
      <title>Disable the GNOME3 Login User List</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_disable_user_list_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_disable_restart_shutdown_ocil:questionnaire:1">
      <title>Disable the GNOME3 Login Restart and Shutdown Buttons</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_disable_restart_shutdown_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_enable_smartcard_auth_ocil:questionnaire:1">
      <title>Enable the GNOME3 Login Smartcard Authentication</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_enable_smartcard_auth_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_login_retries_ocil:questionnaire:1">
      <title>Set the GNOME3 Login Number of Failures</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_login_retries_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_screensaver_idle_delay_ocil:questionnaire:1">
      <title>Set GNOME3 Screensaver Inactivity Timeout</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_screensaver_idle_delay_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_ocil:questionnaire:1">
      <title>Enable GNOME3 Screensaver Idle Activation</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_ocil:questionnaire:1">
      <title>Enable GNOME3 Screensaver Lock After Idle Period</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_screensaver_lock_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_screensaver_lock_delay_ocil:questionnaire:1">
      <title>Set GNOME3 Screensaver Lock Delay After Activation Period</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_screensaver_lock_delay_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_screensaver_mode_blank_ocil:questionnaire:1">
      <title>Implement Blank Screensaver</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_screensaver_mode_blank_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_screensaver_user_info_ocil:questionnaire:1">
      <title>Disable Full User Name on Splash Shield</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_screensaver_user_info_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_session_user_locks_ocil:questionnaire:1">
      <title>Ensure Users Cannot Change GNOME3 Session Settings</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_session_user_locks_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_ocil:questionnaire:1">
      <title>Disable Ctrl-Alt-Del Reboot Key Sequence in GNOME3</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_disable_user_admin_ocil:questionnaire:1">
      <title>Disable User Administration in GNOME3</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_disable_user_admin_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_disable_power_settings_ocil:questionnaire:1">
      <title>Disable Power Settings in GNOME3</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_disable_power_settings_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_disable_geolocation_ocil:questionnaire:1">
      <title>Disable Geolocation in GNOME3</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_disable_geolocation_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_disable_wifi_create_ocil:questionnaire:1">
      <title>Disable WIFI Network Connection Creation in GNOME3</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_disable_wifi_create_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_disable_wifi_notification_ocil:questionnaire:1">
      <title>Disable WIFI Network Notification in GNOME3</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_disable_wifi_notification_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_ocil:questionnaire:1">
      <title>Require Credential Prompting for Remote Access in GNOME3</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_remote_access_credential_prompt_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_remote_access_encryption_ocil:questionnaire:1">
      <title>Require Encryption for Remote Access in GNOME3</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_remote_access_encryption_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_disable_automount_ocil:questionnaire:1">
      <title>Disable GNOME3 Automounting</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_disable_automount_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_disable_thumbnailers_ocil:questionnaire:1">
      <title>Disable All GNOME3 Thumbnailers</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_disable_thumbnailers_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1">
      <title>Ensure Users Re-Authenticate for Privilege Escalation - sudo NOPASSWD</title>
      <actions>
        <test_action_ref>ocil:ssg-sudo_remove_nopasswd_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sudo_remove_no_authenticate_ocil:questionnaire:1">
      <title>Ensure Users Re-Authenticate for Privilege Escalation - sudo !authenticate</title>
      <actions>
        <test_action_ref>ocil:ssg-sudo_remove_no_authenticate_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-mount_option_noexec_removable_partitions_ocil:questionnaire:1">
      <title>Add noexec Option to Removable Media Partitions</title>
      <actions>
        <test_action_ref>ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-kernel_module_usb-storage_disabled_ocil:questionnaire:1">
      <title>Disable Modprobe Loading of USB Storage Driver</title>
      <actions>
        <test_action_ref>ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_autofs_disabled_ocil:questionnaire:1">
      <title>Disable the Automounter</title>
      <actions>
        <test_action_ref>ocil:ssg-service_autofs_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-userowner_shadow_file_ocil:questionnaire:1">
      <title>Verify User Who Owns shadow File</title>
      <actions>
        <test_action_ref>ocil:ssg-userowner_shadow_file_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-groupowner_shadow_file_ocil:questionnaire:1">
      <title>Verify Group Who Owns shadow File</title>
      <actions>
        <test_action_ref>ocil:ssg-groupowner_shadow_file_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_etc_shadow_ocil:questionnaire:1">
      <title>Verify Permissions on shadow File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_etc_shadow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_owner_etc_group_ocil:questionnaire:1">
      <title>Verify User Who Owns group File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_owner_etc_group_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_groupowner_etc_group_ocil:questionnaire:1">
      <title>Verify Group Who Owns group File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_groupowner_etc_group_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_etc_group_ocil:questionnaire:1">
      <title>Verify Permissions on group File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_etc_group_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_owner_etc_gshadow_ocil:questionnaire:1">
      <title>Verify User Who Owns gshadow File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_owner_etc_gshadow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_groupowner_etc_gshadow_ocil:questionnaire:1">
      <title>Verify Group Who Owns gshadow File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_etc_gshadow_ocil:questionnaire:1">
      <title>Verify Permissions on gshadow File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_etc_gshadow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_owner_etc_passwd_ocil:questionnaire:1">
      <title>Verify User Who Owns passwd File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_owner_etc_passwd_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_groupowner_etc_passwd_ocil:questionnaire:1">
      <title>Verify Group Who Owns passwd File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_groupowner_etc_passwd_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_etc_passwd_ocil:questionnaire:1">
      <title>Verify Permissions on passwd File</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_etc_passwd_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_library_dirs_ocil:questionnaire:1">
      <title>Verify that Shared Library Files Have Restrictive Permissions</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_library_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_ownership_library_dirs_ocil:questionnaire:1">
      <title>Verify that Shared Library Files Have Root Ownership</title>
      <actions>
        <test_action_ref>ocil:ssg-file_ownership_library_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_binary_dirs_ocil:questionnaire:1">
      <title>Verify that System Executables Have Restrictive Permissions</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_binary_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_ownership_binary_dirs_ocil:questionnaire:1">
      <title>Verify that System Executables Have Root Ownership</title>
      <actions>
        <test_action_ref>ocil:ssg-file_ownership_binary_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dir_perms_world_writable_sticky_bits_ocil:questionnaire:1">
      <title>Verify that All World-Writable Directories Have Sticky Bits Set</title>
      <actions>
        <test_action_ref>ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_unauthorized_world_writable_ocil:questionnaire:1">
      <title>Ensure No World-Writable Files Exist</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_unauthorized_sgid_ocil:questionnaire:1">
      <title>Ensure All SGID Executables Are Authorized</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_unauthorized_sgid_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_unauthorized_suid_ocil:questionnaire:1">
      <title>Ensure All SUID Executables Are Authorized</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_unauthorized_suid_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-no_files_unowned_by_user_ocil:questionnaire:1">
      <title>Ensure All Files Are Owned by a User</title>
      <actions>
        <test_action_ref>ocil:ssg-no_files_unowned_by_user_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_ungroupowned_ocil:questionnaire:1">
      <title>Ensure All Files Are Owned by a Group</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_ungroupowned_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dir_perms_world_writable_system_owned_ocil:questionnaire:1">
      <title>Ensure All World-Writable Directories Are Owned by a System Account</title>
      <actions>
        <test_action_ref>ocil:ssg-dir_perms_world_writable_system_owned_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-umask_for_daemons_ocil:questionnaire:1">
      <title>Set Daemon Umask</title>
      <actions>
        <test_action_ref>ocil:ssg-umask_for_daemons_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-disable_users_coredumps_ocil:questionnaire:1">
      <title>Disable Core Dumps for All Users</title>
      <actions>
        <test_action_ref>ocil:ssg-disable_users_coredumps_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_fs_suid_dumpable_ocil:questionnaire:1">
      <title>Disable Core Dumps for SUID programs</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_kernel_exec_shield_ocil:questionnaire:1">
      <title>Enable ExecShield</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_kernel_exec_shield_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_kernel_randomize_va_space_ocil:questionnaire:1">
      <title>Enable Randomized Layout of Virtual Address Space</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_kernel_dmesg_restrict_ocil:questionnaire:1">
      <title>Restrict Access to Kernel Message Buffer</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-enable_selinux_bootloader_ocil:questionnaire:1">
      <title>Ensure SELinux Not Disabled in /etc/default/grub</title>
      <actions>
        <test_action_ref>ocil:ssg-enable_selinux_bootloader_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-selinux_state_ocil:questionnaire:1">
      <title>Ensure SELinux State is Enforcing</title>
      <actions>
        <test_action_ref>ocil:ssg-selinux_state_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-selinux_policytype_ocil:questionnaire:1">
      <title>Configure SELinux Policy</title>
      <actions>
        <test_action_ref>ocil:ssg-selinux_policytype_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-selinux_all_devicefiles_labeled_ocil:questionnaire:1">
      <title>Ensure No Device Files are Unlabeled by SELinux</title>
      <actions>
        <test_action_ref>ocil:ssg-selinux_all_devicefiles_labeled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_abrt_anon_write_ocil:questionnaire:1">
      <title>Disable the abrt_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_abrt_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_abrt_handle_event_ocil:questionnaire:1">
      <title>Disable the abrt_handle_event SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_abrt_handle_event_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_abrt_upload_watch_anon_write_ocil:questionnaire:1">
      <title>Disable the abrt_upload_watch_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_abrt_upload_watch_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_antivirus_can_scan_system_ocil:questionnaire:1">
      <title>Enable the antivirus_can_scan_system SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_antivirus_can_scan_system_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_antivirus_use_jit_ocil:questionnaire:1">
      <title>Disable the antivirus_use_jit SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_antivirus_use_jit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_auditadm_exec_content_ocil:questionnaire:1">
      <title>Enable the auditadm_exec_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_auditadm_exec_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_authlogin_nsswitch_use_ldap_ocil:questionnaire:1">
      <title>Disable the authlogin_nsswitch_use_ldap SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_authlogin_nsswitch_use_ldap_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_authlogin_radius_ocil:questionnaire:1">
      <title>Disable the authlogin_radius SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_authlogin_radius_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_authlogin_yubikey_ocil:questionnaire:1">
      <title>Disable the authlogin_yubikey SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_authlogin_yubikey_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_awstats_purge_apache_log_files_ocil:questionnaire:1">
      <title>Disable the awstats_purge_apache_log_files SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_awstats_purge_apache_log_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_boinc_execmem_ocil:questionnaire:1">
      <title>Disable the boinc_execmem SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_boinc_execmem_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cdrecord_read_content_ocil:questionnaire:1">
      <title>Disable the cdrecord_read_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cdrecord_read_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cluster_can_network_connect_ocil:questionnaire:1">
      <title>Disable the cluster_can_network_connect SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cluster_can_network_connect_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cluster_manage_all_files_ocil:questionnaire:1">
      <title>Disable the cluster_manage_all_files SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cluster_manage_all_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cluster_use_execmem_ocil:questionnaire:1">
      <title>Disable the cluster_use_execmem SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cluster_use_execmem_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cobbler_anon_write_ocil:questionnaire:1">
      <title>Disable the cobbler_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cobbler_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cobbler_can_network_connect_ocil:questionnaire:1">
      <title>Disable the cobbler_can_network_connect SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cobbler_can_network_connect_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cobbler_use_cifs_ocil:questionnaire:1">
      <title>Disable the cobbler_use_cifs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cobbler_use_cifs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cobbler_use_nfs_ocil:questionnaire:1">
      <title>Disable the cobbler_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cobbler_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_collectd_tcp_network_connect_ocil:questionnaire:1">
      <title>Disable the collectd_tcp_network_connect SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_collectd_tcp_network_connect_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_condor_tcp_network_connect_ocil:questionnaire:1">
      <title>Disable the condor_tcp_network_connect SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_condor_tcp_network_connect_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_conman_can_network_ocil:questionnaire:1">
      <title>Disable the conman_can_network SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_conman_can_network_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cron_can_relabel_ocil:questionnaire:1">
      <title>Disable the cron_can_relabel SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cron_can_relabel_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cron_system_cronjob_use_shares_ocil:questionnaire:1">
      <title>Disable the cron_system_cronjob_use_shares SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cron_system_cronjob_use_shares_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cron_userdomain_transition_ocil:questionnaire:1">
      <title>Enable the cron_userdomain_transition SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cron_userdomain_transition_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cups_execmem_ocil:questionnaire:1">
      <title>Disable the cups_execmem SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cups_execmem_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_cvs_read_shadow_ocil:questionnaire:1">
      <title>Disable the cvs_read_shadow SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_cvs_read_shadow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_daemons_dump_core_ocil:questionnaire:1">
      <title>Disable the daemons_dump_core SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_daemons_dump_core_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_daemons_enable_cluster_mode_ocil:questionnaire:1">
      <title>Disable the daemons_enable_cluster_mode SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_daemons_enable_cluster_mode_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_daemons_use_tcp_wrapper_ocil:questionnaire:1">
      <title>Disable the daemons_use_tcp_wrapper SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_daemons_use_tcp_wrapper_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_daemons_use_tty_ocil:questionnaire:1">
      <title>Disable the daemons_use_tty SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_daemons_use_tty_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_dbadm_exec_content_ocil:questionnaire:1">
      <title>Enable the dbadm_exec_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_dbadm_exec_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_dbadm_manage_user_files_ocil:questionnaire:1">
      <title>Disable the dbadm_manage_user_files SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_dbadm_manage_user_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_dbadm_read_user_files_ocil:questionnaire:1">
      <title>Disable the dbadm_read_user_files SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_dbadm_read_user_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_deny_execmem_ocil:questionnaire:1">
      <title>Disable the deny_execmem SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_deny_execmem_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_deny_ptrace_ocil:questionnaire:1">
      <title>Disable the deny_ptrace SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_deny_ptrace_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_dhcpc_exec_iptables_ocil:questionnaire:1">
      <title>Disable the dhcpc_exec_iptables SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_dhcpc_exec_iptables_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_dhcpd_use_ldap_ocil:questionnaire:1">
      <title>Disable the dhcpd_use_ldap SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_dhcpd_use_ldap_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_docker_connect_any_ocil:questionnaire:1">
      <title>Disable the docker_connect_any SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_docker_connect_any_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_docker_transition_unconfined_ocil:questionnaire:1">
      <title>Enable the docker_transition_unconfined SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_docker_transition_unconfined_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_domain_fd_use_ocil:questionnaire:1">
      <title>Enable the domain_fd_use SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_domain_fd_use_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_domain_kernel_load_modules_ocil:questionnaire:1">
      <title>Disable the domain_kernel_load_modules SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_domain_kernel_load_modules_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_entropyd_use_audio_ocil:questionnaire:1">
      <title>Disable the entropyd_use_audio SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_entropyd_use_audio_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_exim_can_connect_db_ocil:questionnaire:1">
      <title>Disable the exim_can_connect_db SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_exim_can_connect_db_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_exim_manage_user_files_ocil:questionnaire:1">
      <title>Disable the exim_manage_user_files SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_exim_manage_user_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_exim_read_user_files_ocil:questionnaire:1">
      <title>Disable the exim_read_user_files SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_exim_read_user_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_fcron_crond_ocil:questionnaire:1">
      <title>Disable the fcron_crond SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_fcron_crond_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_fenced_can_network_connect_ocil:questionnaire:1">
      <title>Disable the fenced_can_network_connect SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_fenced_can_network_connect_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_fenced_can_ssh_ocil:questionnaire:1">
      <title>Disable the fenced_can_ssh SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_fenced_can_ssh_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_fips_mode_ocil:questionnaire:1">
      <title>Enable the fips_mode SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_fips_mode_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ftpd_anon_write_ocil:questionnaire:1">
      <title>Disable the ftpd_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ftpd_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ftpd_connect_all_unreserved_ocil:questionnaire:1">
      <title>Disable the ftpd_connect_all_unreserved SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ftpd_connect_all_unreserved_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ftpd_connect_db_ocil:questionnaire:1">
      <title>Disable the ftpd_connect_db SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ftpd_connect_db_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ftpd_full_access_ocil:questionnaire:1">
      <title>Disable the ftpd_full_access SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ftpd_full_access_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ftpd_use_cifs_ocil:questionnaire:1">
      <title>Disable the ftpd_use_cifs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ftpd_use_cifs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ftpd_use_fusefs_ocil:questionnaire:1">
      <title>Disable the ftpd_use_fusefs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ftpd_use_fusefs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ftpd_use_nfs_ocil:questionnaire:1">
      <title>Disable the ftpd_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ftpd_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ftpd_use_passive_mode_ocil:questionnaire:1">
      <title>Disable the ftpd_use_passive_mode SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ftpd_use_passive_mode_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ftp_home_dir_ocil:questionnaire:1">
      <title>Disable the ftp_home_dir SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ftp_home_dir_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_git_cgi_enable_homedirs_ocil:questionnaire:1">
      <title>Disable the git_cgi_enable_homedirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_git_cgi_enable_homedirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_git_cgi_use_cifs_ocil:questionnaire:1">
      <title>Disable the git_cgi_use_cifs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_git_cgi_use_cifs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_git_cgi_use_nfs_ocil:questionnaire:1">
      <title>Disable the git_cgi_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_git_cgi_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_gitosis_can_sendmail_ocil:questionnaire:1">
      <title>Disable the gitosis_can_sendmail SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_gitosis_can_sendmail_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_git_session_bind_all_unreserved_ports_ocil:questionnaire:1">
      <title>Disable the git_session_bind_all_unreserved_ports SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_git_session_bind_all_unreserved_ports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_git_session_users_ocil:questionnaire:1">
      <title>Disable the git_session_users SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_git_session_users_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_git_system_enable_homedirs_ocil:questionnaire:1">
      <title>Disable the git_system_enable_homedirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_git_system_enable_homedirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_git_system_use_cifs_ocil:questionnaire:1">
      <title>Disable the git_system_use_cifs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_git_system_use_cifs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_git_system_use_nfs_ocil:questionnaire:1">
      <title>Disable the git_system_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_git_system_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_glance_api_can_network_ocil:questionnaire:1">
      <title>Disable the glance_api_can_network SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_glance_api_can_network_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_glance_use_execmem_ocil:questionnaire:1">
      <title>Disable the glance_use_execmem SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_glance_use_execmem_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_glance_use_fusefs_ocil:questionnaire:1">
      <title>Disable the glance_use_fusefs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_glance_use_fusefs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_global_ssp_ocil:questionnaire:1">
      <title>Disable the global_ssp SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_global_ssp_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_gluster_anon_write_ocil:questionnaire:1">
      <title>Disable the gluster_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_gluster_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_gluster_export_all_ro_ocil:questionnaire:1">
      <title>Disable the gluster_export_all_ro SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_gluster_export_all_ro_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_gluster_export_all_rw_ocil:questionnaire:1">
      <title>Configure the gluster_export_all_rw SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_gluster_export_all_rw_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_gpg_web_anon_write_ocil:questionnaire:1">
      <title>Disable the gpg_web_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_gpg_web_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_gssd_read_tmp_ocil:questionnaire:1">
      <title>Enable the gssd_read_tmp SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_gssd_read_tmp_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_guest_exec_content_ocil:questionnaire:1">
      <title>Disable the guest_exec_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_guest_exec_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_haproxy_connect_any_ocil:questionnaire:1">
      <title>Disable the haproxy_connect_any SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_haproxy_connect_any_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_anon_write_ocil:questionnaire:1">
      <title>Disable the httpd_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_builtin_scripting_ocil:questionnaire:1">
      <title>Configure the httpd_builtin_scripting SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_builtin_scripting_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_check_spam_ocil:questionnaire:1">
      <title>Disable the httpd_can_check_spam SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_check_spam_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_connect_ftp_ocil:questionnaire:1">
      <title>Disable the httpd_can_connect_ftp SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_connect_ftp_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_connect_ldap_ocil:questionnaire:1">
      <title>Disable the httpd_can_connect_ldap SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_connect_ldap_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_connect_mythtv_ocil:questionnaire:1">
      <title>Disable the httpd_can_connect_mythtv SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_connect_mythtv_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_connect_zabbix_ocil:questionnaire:1">
      <title>Disable the httpd_can_connect_zabbix SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_connect_zabbix_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_network_connect_cobbler_ocil:questionnaire:1">
      <title>Disable the httpd_can_network_connect_cobbler SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_network_connect_cobbler_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_network_connect_db_ocil:questionnaire:1">
      <title>Disable the httpd_can_network_connect_db SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_network_connect_db_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_network_connect_ocil:questionnaire:1">
      <title>Disable the httpd_can_network_connect SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_network_connect_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_network_memcache_ocil:questionnaire:1">
      <title>Disable the httpd_can_network_memcache SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_network_memcache_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_network_relay_ocil:questionnaire:1">
      <title>Disable the httpd_can_network_relay SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_network_relay_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_can_sendmail_ocil:questionnaire:1">
      <title>Disable the httpd_can_sendmail SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_can_sendmail_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_dbus_avahi_ocil:questionnaire:1">
      <title>Disable the httpd_dbus_avahi SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_dbus_avahi_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_dbus_sssd_ocil:questionnaire:1">
      <title>Disable the httpd_dbus_sssd SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_dbus_sssd_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_dontaudit_search_dirs_ocil:questionnaire:1">
      <title>Disable the httpd_dontaudit_search_dirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_dontaudit_search_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_enable_cgi_ocil:questionnaire:1">
      <title>Configure the httpd_enable_cgi SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_enable_cgi_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_enable_ftp_server_ocil:questionnaire:1">
      <title>Disable the httpd_enable_ftp_server SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_enable_ftp_server_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_enable_homedirs_ocil:questionnaire:1">
      <title>Disable the httpd_enable_homedirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_enable_homedirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_execmem_ocil:questionnaire:1">
      <title>Disable the httpd_execmem SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_execmem_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_graceful_shutdown_ocil:questionnaire:1">
      <title>Enable the httpd_graceful_shutdown SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_graceful_shutdown_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_manage_ipa_ocil:questionnaire:1">
      <title>Disable the httpd_manage_ipa SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_manage_ipa_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_mod_auth_ntlm_winbind_ocil:questionnaire:1">
      <title>Disable the httpd_mod_auth_ntlm_winbind SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_mod_auth_ntlm_winbind_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_mod_auth_pam_ocil:questionnaire:1">
      <title>Disable the httpd_mod_auth_pam SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_mod_auth_pam_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_read_user_content_ocil:questionnaire:1">
      <title>Disable the httpd_read_user_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_read_user_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_run_ipa_ocil:questionnaire:1">
      <title>Disable the httpd_run_ipa SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_run_ipa_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_run_preupgrade_ocil:questionnaire:1">
      <title>Disable the httpd_run_preupgrade SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_run_preupgrade_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_run_stickshift_ocil:questionnaire:1">
      <title>Disable the httpd_run_stickshift SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_run_stickshift_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_serve_cobbler_files_ocil:questionnaire:1">
      <title>Disable the httpd_serve_cobbler_files SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_serve_cobbler_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_setrlimit_ocil:questionnaire:1">
      <title>Disable the httpd_setrlimit SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_setrlimit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_ssi_exec_ocil:questionnaire:1">
      <title>Disable the httpd_ssi_exec SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_ssi_exec_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_sys_script_anon_write_ocil:questionnaire:1">
      <title>Disable the httpd_sys_script_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_sys_script_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_tmp_exec_ocil:questionnaire:1">
      <title>Disable the httpd_tmp_exec SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_tmp_exec_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_tty_comm_ocil:questionnaire:1">
      <title>Disable the httpd_tty_comm SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_tty_comm_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_unified_ocil:questionnaire:1">
      <title>Disable the httpd_unified SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_unified_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_use_cifs_ocil:questionnaire:1">
      <title>Disable the httpd_use_cifs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_use_cifs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_use_fusefs_ocil:questionnaire:1">
      <title>Disable the httpd_use_fusefs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_use_fusefs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_use_gpg_ocil:questionnaire:1">
      <title>Disable the httpd_use_gpg SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_use_gpg_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_use_nfs_ocil:questionnaire:1">
      <title>Disable the httpd_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_use_openstack_ocil:questionnaire:1">
      <title>Disable the httpd_use_openstack SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_use_openstack_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_use_sasl_ocil:questionnaire:1">
      <title>Disable the httpd_use_sasl SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_use_sasl_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_httpd_verify_dns_ocil:questionnaire:1">
      <title>Disable the httpd_verify_dns SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_httpd_verify_dns_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_icecast_use_any_tcp_ports_ocil:questionnaire:1">
      <title>Disable the icecast_use_any_tcp_ports SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_icecast_use_any_tcp_ports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_irc_use_any_tcp_ports_ocil:questionnaire:1">
      <title>Disable the irc_use_any_tcp_ports SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_irc_use_any_tcp_ports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_irssi_use_full_network_ocil:questionnaire:1">
      <title>Disable the irssi_use_full_network SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_irssi_use_full_network_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_kdumpgui_run_bootloader_ocil:questionnaire:1">
      <title>Disable the kdumpgui_run_bootloader SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_kdumpgui_run_bootloader_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_kerberos_enabled_ocil:questionnaire:1">
      <title>Enable the kerberos_enabled SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_kerberos_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ksmtuned_use_cifs_ocil:questionnaire:1">
      <title>Disable the ksmtuned_use_cifs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ksmtuned_use_cifs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ksmtuned_use_nfs_ocil:questionnaire:1">
      <title>Disable the ksmtuned_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ksmtuned_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_logadm_exec_content_ocil:questionnaire:1">
      <title>Enable the logadm_exec_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_logadm_exec_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_logging_syslogd_can_sendmail_ocil:questionnaire:1">
      <title>Disable the logging_syslogd_can_sendmail SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_logging_syslogd_can_sendmail_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_logging_syslogd_run_nagios_plugins_ocil:questionnaire:1">
      <title>Disable the logging_syslogd_run_nagios_plugins SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_logging_syslogd_run_nagios_plugins_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_logging_syslogd_use_tty_ocil:questionnaire:1">
      <title>Enable the logging_syslogd_use_tty SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_logging_syslogd_use_tty_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_login_console_enabled_ocil:questionnaire:1">
      <title>Enable the login_console_enabled SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_login_console_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_logrotate_use_nfs_ocil:questionnaire:1">
      <title>Disable the logrotate_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_logrotate_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_logwatch_can_network_connect_mail_ocil:questionnaire:1">
      <title>Disable the logwatch_can_network_connect_mail SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_logwatch_can_network_connect_mail_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_lsmd_plugin_connect_any_ocil:questionnaire:1">
      <title>Disable the lsmd_plugin_connect_any SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_lsmd_plugin_connect_any_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mailman_use_fusefs_ocil:questionnaire:1">
      <title>Disable the mailman_use_fusefs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mailman_use_fusefs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mcelog_client_ocil:questionnaire:1">
      <title>Disable the mcelog_client SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mcelog_client_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mcelog_exec_scripts_ocil:questionnaire:1">
      <title>Enable the mcelog_exec_scripts SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mcelog_exec_scripts_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mcelog_foreground_ocil:questionnaire:1">
      <title>Disable the mcelog_foreground SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mcelog_foreground_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mcelog_server_ocil:questionnaire:1">
      <title>Disable the mcelog_server SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mcelog_server_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_minidlna_read_generic_user_content_ocil:questionnaire:1">
      <title>Disable the minidlna_read_generic_user_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_minidlna_read_generic_user_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mmap_low_allowed_ocil:questionnaire:1">
      <title>Disable the mmap_low_allowed SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mmap_low_allowed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mock_enable_homedirs_ocil:questionnaire:1">
      <title>Disable the mock_enable_homedirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mock_enable_homedirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mount_anyfile_ocil:questionnaire:1">
      <title>Enable the mount_anyfile SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mount_anyfile_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mozilla_plugin_bind_unreserved_ports_ocil:questionnaire:1">
      <title>Disable the mozilla_plugin_bind_unreserved_ports SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mozilla_plugin_bind_unreserved_ports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mozilla_plugin_can_network_connect_ocil:questionnaire:1">
      <title>Disable the mozilla_plugin_can_network_connect SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mozilla_plugin_can_network_connect_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mozilla_plugin_use_bluejeans_ocil:questionnaire:1">
      <title>Disable the mozilla_plugin_use_bluejeans SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mozilla_plugin_use_bluejeans_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mozilla_plugin_use_gps_ocil:questionnaire:1">
      <title>Disable the mozilla_plugin_use_gps SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mozilla_plugin_use_gps_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mozilla_plugin_use_spice_ocil:questionnaire:1">
      <title>Disable the mozilla_plugin_use_spice SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mozilla_plugin_use_spice_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mozilla_read_content_ocil:questionnaire:1">
      <title>Disable the mozilla_read_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mozilla_read_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mpd_enable_homedirs_ocil:questionnaire:1">
      <title>Disable the mpd_enable_homedirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mpd_enable_homedirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mpd_use_cifs_ocil:questionnaire:1">
      <title>Disable the mpd_use_cifs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mpd_use_cifs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mpd_use_nfs_ocil:questionnaire:1">
      <title>Disable the mpd_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mpd_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mplayer_execstack_ocil:questionnaire:1">
      <title>Disable the mplayer_execstack SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mplayer_execstack_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_mysql_connect_any_ocil:questionnaire:1">
      <title>Disable the mysql_connect_any SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_mysql_connect_any_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_nagios_run_pnp4nagios_ocil:questionnaire:1">
      <title>Disable the nagios_run_pnp4nagios SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_nagios_run_pnp4nagios_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_nagios_run_sudo_ocil:questionnaire:1">
      <title>Disable the nagios_run_sudo SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_nagios_run_sudo_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_named_tcp_bind_http_port_ocil:questionnaire:1">
      <title>Disable the named_tcp_bind_http_port SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_named_tcp_bind_http_port_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_named_write_master_zones_ocil:questionnaire:1">
      <title>Disable the named_write_master_zones SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_named_write_master_zones_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_neutron_can_network_ocil:questionnaire:1">
      <title>Disable the neutron_can_network SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_neutron_can_network_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_nfsd_anon_write_ocil:questionnaire:1">
      <title>Disable the nfsd_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_nfsd_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_nfs_export_all_ro_ocil:questionnaire:1">
      <title>Enable the nfs_export_all_ro SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_nfs_export_all_ro_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_nfs_export_all_rw_ocil:questionnaire:1">
      <title>Enable the nfs_export_all_rw SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_nfs_export_all_rw_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_nis_enabled_ocil:questionnaire:1">
      <title>Disable the nis_enabled SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_nis_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_nscd_use_shm_ocil:questionnaire:1">
      <title>Enable the nscd_use_shm SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_nscd_use_shm_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_openshift_use_nfs_ocil:questionnaire:1">
      <title>Disable the openshift_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_openshift_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_openvpn_can_network_connect_ocil:questionnaire:1">
      <title>Disable the openvpn_can_network_connect SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_openvpn_can_network_connect_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_openvpn_enable_homedirs_ocil:questionnaire:1">
      <title>Disable the openvpn_enable_homedirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_openvpn_enable_homedirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_openvpn_run_unconfined_ocil:questionnaire:1">
      <title>Disable the openvpn_run_unconfined SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_openvpn_run_unconfined_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_pcp_bind_all_unreserved_ports_ocil:questionnaire:1">
      <title>Disable the pcp_bind_all_unreserved_ports SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_pcp_bind_all_unreserved_ports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_pcp_read_generic_logs_ocil:questionnaire:1">
      <title>Disable the pcp_read_generic_logs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_pcp_read_generic_logs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_piranha_lvs_can_network_connect_ocil:questionnaire:1">
      <title>Disable the piranha_lvs_can_network_connect SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_piranha_lvs_can_network_connect_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_polipo_connect_all_unreserved_ocil:questionnaire:1">
      <title>Disable the polipo_connect_all_unreserved SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_polipo_connect_all_unreserved_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_polipo_session_bind_all_unreserved_ports_ocil:questionnaire:1">
      <title>Disable the polipo_session_bind_all_unreserved_ports SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_polipo_session_bind_all_unreserved_ports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_polipo_session_users_ocil:questionnaire:1">
      <title>Disable the polipo_session_users SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_polipo_session_users_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_polipo_use_cifs_ocil:questionnaire:1">
      <title>Disable the polipo_use_cifs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_polipo_use_cifs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_polipo_use_nfs_ocil:questionnaire:1">
      <title>Disable the polipo_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_polipo_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_polyinstantiation_enabled_ocil:questionnaire:1">
      <title>Disable the polyinstantiation_enabled SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_polyinstantiation_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_postfix_local_write_mail_spool_ocil:questionnaire:1">
      <title>Enable the postfix_local_write_mail_spool SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_postfix_local_write_mail_spool_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_postgresql_can_rsync_ocil:questionnaire:1">
      <title>Disable the postgresql_can_rsync SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_postgresql_can_rsync_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_postgresql_selinux_transmit_client_label_ocil:questionnaire:1">
      <title>Disable the postgresql_selinux_transmit_client_label SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_postgresql_selinux_transmit_client_label_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_postgresql_selinux_unconfined_dbadm_ocil:questionnaire:1">
      <title>Enable the postgresql_selinux_unconfined_dbadm SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_postgresql_selinux_unconfined_dbadm_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_postgresql_selinux_users_ddl_ocil:questionnaire:1">
      <title>Enable the postgresql_selinux_users_ddl SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_postgresql_selinux_users_ddl_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_pppd_can_insmod_ocil:questionnaire:1">
      <title>Disable the pppd_can_insmod SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_pppd_can_insmod_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_pppd_for_user_ocil:questionnaire:1">
      <title>Disable the pppd_for_user SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_pppd_for_user_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_privoxy_connect_any_ocil:questionnaire:1">
      <title>Disable the privoxy_connect_any SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_privoxy_connect_any_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_prosody_bind_http_port_ocil:questionnaire:1">
      <title>Disable the prosody_bind_http_port SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_prosody_bind_http_port_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_puppetagent_manage_all_files_ocil:questionnaire:1">
      <title>Disable the puppetagent_manage_all_files SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_puppetagent_manage_all_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_puppetmaster_use_db_ocil:questionnaire:1">
      <title>Disable the puppetmaster_use_db SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_puppetmaster_use_db_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_racoon_read_shadow_ocil:questionnaire:1">
      <title>Disable the racoon_read_shadow SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_racoon_read_shadow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_rsync_anon_write_ocil:questionnaire:1">
      <title>Disable the rsync_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_rsync_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_rsync_client_ocil:questionnaire:1">
      <title>Disable the rsync_client SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_rsync_client_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_rsync_export_all_ro_ocil:questionnaire:1">
      <title>Disable the rsync_export_all_ro SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_rsync_export_all_ro_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_rsync_full_access_ocil:questionnaire:1">
      <title>Disable the rsync_full_access SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_rsync_full_access_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_samba_create_home_dirs_ocil:questionnaire:1">
      <title>Disable the samba_create_home_dirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_samba_create_home_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_samba_domain_controller_ocil:questionnaire:1">
      <title>Disable the samba_domain_controller SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_samba_domain_controller_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_samba_enable_home_dirs_ocil:questionnaire:1">
      <title>Disable the samba_enable_home_dirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_samba_enable_home_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_samba_export_all_ro_ocil:questionnaire:1">
      <title>Disable the samba_export_all_ro SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_samba_export_all_ro_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_samba_export_all_rw_ocil:questionnaire:1">
      <title>Disable the samba_export_all_rw SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_samba_export_all_rw_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_samba_load_libgfapi_ocil:questionnaire:1">
      <title>Disable the samba_load_libgfapi SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_samba_load_libgfapi_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_samba_portmapper_ocil:questionnaire:1">
      <title>Disable the samba_portmapper SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_samba_portmapper_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_samba_run_unconfined_ocil:questionnaire:1">
      <title>Disable the samba_run_unconfined SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_samba_run_unconfined_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_samba_share_fusefs_ocil:questionnaire:1">
      <title>Disable the samba_share_fusefs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_samba_share_fusefs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_samba_share_nfs_ocil:questionnaire:1">
      <title>Disable the samba_share_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_samba_share_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_sanlock_use_fusefs_ocil:questionnaire:1">
      <title>Disable the sanlock_use_fusefs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_sanlock_use_fusefs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_sanlock_use_nfs_ocil:questionnaire:1">
      <title>Disable the sanlock_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_sanlock_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_sanlock_use_samba_ocil:questionnaire:1">
      <title>Disable the sanlock_use_samba SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_sanlock_use_samba_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_saslauthd_read_shadow_ocil:questionnaire:1">
      <title>Disable the saslauthd_read_shadow SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_saslauthd_read_shadow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_secadm_exec_content_ocil:questionnaire:1">
      <title>Enable the secadm_exec_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_secadm_exec_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_secure_mode_insmod_ocil:questionnaire:1">
      <title>Disable the secure_mode_insmod SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_secure_mode_insmod_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_secure_mode_ocil:questionnaire:1">
      <title>Disable the secure_mode SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_secure_mode_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_secure_mode_policyload_ocil:questionnaire:1">
      <title>Disable the secure_mode_policyload SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_secure_mode_policyload_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_direct_dri_enabled_ocil:questionnaire:1">
      <title>Configure the selinuxuser_direct_dri_enabled SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_direct_dri_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_execheap_ocil:questionnaire:1">
      <title>Disable the selinuxuser_execheap SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_execheap_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_execmod_ocil:questionnaire:1">
      <title>Enable the selinuxuser_execmod SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_execmod_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_execstack_ocil:questionnaire:1">
      <title>disable the selinuxuser_execstack SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_execstack_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_mysql_connect_enabled_ocil:questionnaire:1">
      <title>Disable the selinuxuser_mysql_connect_enabled SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_mysql_connect_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_ping_ocil:questionnaire:1">
      <title>Enable the selinuxuser_ping SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_ping_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_postgresql_connect_enabled_ocil:questionnaire:1">
      <title>Disable the selinuxuser_postgresql_connect_enabled SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_postgresql_connect_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_rw_noexattrfile_ocil:questionnaire:1">
      <title>Disable the selinuxuser_rw_noexattrfile SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_rw_noexattrfile_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_share_music_ocil:questionnaire:1">
      <title>Disable the selinuxuser_share_music SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_share_music_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_tcp_server_ocil:questionnaire:1">
      <title>Disable the selinuxuser_tcp_server SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_tcp_server_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_udp_server_ocil:questionnaire:1">
      <title>Disable the selinuxuser_udp_server SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_udp_server_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_selinuxuser_use_ssh_chroot_ocil:questionnaire:1">
      <title>Disable the selinuxuser_use_ssh_chroot SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_selinuxuser_use_ssh_chroot_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_sftpd_anon_write_ocil:questionnaire:1">
      <title>Disable the sftpd_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_sftpd_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_sftpd_enable_homedirs_ocil:questionnaire:1">
      <title>Disable the sftpd_enable_homedirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_sftpd_enable_homedirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_sftpd_full_access_ocil:questionnaire:1">
      <title>Disable the sftpd_full_access SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_sftpd_full_access_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_sftpd_write_ssh_home_ocil:questionnaire:1">
      <title>Disable the sftpd_write_ssh_home SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_sftpd_write_ssh_home_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_sge_domain_can_network_connect_ocil:questionnaire:1">
      <title>Disable the sge_domain_can_network_connect SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_sge_domain_can_network_connect_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_sge_use_nfs_ocil:questionnaire:1">
      <title>Disable the sge_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_sge_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_smartmon_3ware_ocil:questionnaire:1">
      <title>Disable the smartmon_3ware SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_smartmon_3ware_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_smbd_anon_write_ocil:questionnaire:1">
      <title>Disable the smbd_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_smbd_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_spamassassin_can_network_ocil:questionnaire:1">
      <title>Disable the spamassassin_can_network SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_spamassassin_can_network_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_spamd_enable_home_dirs_ocil:questionnaire:1">
      <title>Enable the spamd_enable_home_dirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_spamd_enable_home_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_squid_connect_any_ocil:questionnaire:1">
      <title>Disable the squid_connect_any SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_squid_connect_any_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_squid_use_tproxy_ocil:questionnaire:1">
      <title>Disable the squid_use_tproxy SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_squid_use_tproxy_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ssh_chroot_rw_homedirs_ocil:questionnaire:1">
      <title>Disable the ssh_chroot_rw_homedirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ssh_chroot_rw_homedirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ssh_keysign_ocil:questionnaire:1">
      <title>Disable the ssh_keysign SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ssh_keysign_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_ssh_sysadm_login_ocil:questionnaire:1">
      <title>Disable the ssh_sysadm_login SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_ssh_sysadm_login_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_staff_exec_content_ocil:questionnaire:1">
      <title>Enable the staff_exec_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_staff_exec_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_staff_use_svirt_ocil:questionnaire:1">
      <title>Disable the staff_use_svirt SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_staff_use_svirt_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_swift_can_network_ocil:questionnaire:1">
      <title>Disable the swift_can_network SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_swift_can_network_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_sysadm_exec_content_ocil:questionnaire:1">
      <title>Enable the sysadm_exec_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_sysadm_exec_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_telepathy_connect_all_ports_ocil:questionnaire:1">
      <title>Disable the telepathy_connect_all_ports SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_telepathy_connect_all_ports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_telepathy_tcp_connect_generic_network_ports_ocil:questionnaire:1">
      <title>Disable the telepathy_tcp_connect_generic_network_ports SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_telepathy_tcp_connect_generic_network_ports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_tftp_anon_write_ocil:questionnaire:1">
      <title>Disable the tftp_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_tftp_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_tftp_home_dir_ocil:questionnaire:1">
      <title>Disable the tftp_home_dir SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_tftp_home_dir_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_tmpreaper_use_nfs_ocil:questionnaire:1">
      <title>Disable the tmpreaper_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_tmpreaper_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_tmpreaper_use_samba_ocil:questionnaire:1">
      <title>Disable the tmpreaper_use_samba SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_tmpreaper_use_samba_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_tor_bind_all_unreserved_ports_ocil:questionnaire:1">
      <title>Disable the tor_bind_all_unreserved_ports SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_tor_bind_all_unreserved_ports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_tor_can_network_relay_ocil:questionnaire:1">
      <title>Disable the tor_can_network_relay SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_tor_can_network_relay_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_unconfined_chrome_sandbox_transition_ocil:questionnaire:1">
      <title>Enable the unconfined_chrome_sandbox_transition SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_unconfined_chrome_sandbox_transition_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_unconfined_login_ocil:questionnaire:1">
      <title>Enable the unconfined_login SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_unconfined_login_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_unconfined_mozilla_plugin_transition_ocil:questionnaire:1">
      <title>Enable the unconfined_mozilla_plugin_transition SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_unconfined_mozilla_plugin_transition_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_unprivuser_use_svirt_ocil:questionnaire:1">
      <title>Disable the unprivuser_use_svirt SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_unprivuser_use_svirt_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_use_ecryptfs_home_dirs_ocil:questionnaire:1">
      <title>Disable the use_ecryptfs_home_dirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_use_ecryptfs_home_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_use_fusefs_home_dirs_ocil:questionnaire:1">
      <title>Disable the use_fusefs_home_dirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_use_fusefs_home_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_use_lpd_server_ocil:questionnaire:1">
      <title>Disable the use_lpd_server SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_use_lpd_server_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_use_nfs_home_dirs_ocil:questionnaire:1">
      <title>Disable the use_nfs_home_dirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_use_nfs_home_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_user_exec_content_ocil:questionnaire:1">
      <title>Enable the user_exec_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_user_exec_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_use_samba_home_dirs_ocil:questionnaire:1">
      <title>Disable the use_samba_home_dirs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_use_samba_home_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_varnishd_connect_any_ocil:questionnaire:1">
      <title>Disable the varnishd_connect_any SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_varnishd_connect_any_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_read_qemu_ga_data_ocil:questionnaire:1">
      <title>Disable the virt_read_qemu_ga_data SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_read_qemu_ga_data_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_rw_qemu_ga_data_ocil:questionnaire:1">
      <title>Disable the virt_rw_qemu_ga_data SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_rw_qemu_ga_data_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_sandbox_use_all_caps_ocil:questionnaire:1">
      <title>Disable the virt_sandbox_use_all_caps SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_sandbox_use_all_caps_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_sandbox_use_audit_ocil:questionnaire:1">
      <title>Enable the virt_sandbox_use_audit SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_sandbox_use_audit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_sandbox_use_mknod_ocil:questionnaire:1">
      <title>Disable the virt_sandbox_use_mknod SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_sandbox_use_mknod_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_sandbox_use_netlink_ocil:questionnaire:1">
      <title>Disable the virt_sandbox_use_netlink SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_sandbox_use_netlink_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_sandbox_use_nfs_ocil:questionnaire:1">
      <title>Disable the virt_sandbox_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_sandbox_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_sandbox_use_samba_ocil:questionnaire:1">
      <title>Disable the virt_sandbox_use_samba SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_sandbox_use_samba_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_sandbox_use_sys_admin_ocil:questionnaire:1">
      <title>Disable the virt_sandbox_use_sys_admin SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_sandbox_use_sys_admin_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_transition_userdomain_ocil:questionnaire:1">
      <title>Disable the virt_transition_userdomain SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_transition_userdomain_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_use_comm_ocil:questionnaire:1">
      <title>Disable the virt_use_comm SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_use_comm_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_use_execmem_ocil:questionnaire:1">
      <title>Disable the virt_use_execmem SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_use_execmem_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_use_fusefs_ocil:questionnaire:1">
      <title>Disable the virt_use_fusefs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_use_fusefs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_use_nfs_ocil:questionnaire:1">
      <title>Disable the virt_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_use_rawip_ocil:questionnaire:1">
      <title>Disable the virt_use_rawip SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_use_rawip_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_use_samba_ocil:questionnaire:1">
      <title>Disable the virt_use_samba SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_use_samba_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_use_sanlock_ocil:questionnaire:1">
      <title>Disable the virt_use_sanlock SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_use_sanlock_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_use_usb_ocil:questionnaire:1">
      <title>Disable the virt_use_usb SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_use_usb_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_virt_use_xserver_ocil:questionnaire:1">
      <title>Disable the virt_use_xserver SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_virt_use_xserver_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_webadm_manage_user_files_ocil:questionnaire:1">
      <title>Disable the webadm_manage_user_files SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_webadm_manage_user_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_webadm_read_user_files_ocil:questionnaire:1">
      <title>Disable the webadm_read_user_files SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_webadm_read_user_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_wine_mmap_zero_ignore_ocil:questionnaire:1">
      <title>Disable the wine_mmap_zero_ignore SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_wine_mmap_zero_ignore_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xdm_bind_vnc_tcp_port_ocil:questionnaire:1">
      <title>Disable the xdm_bind_vnc_tcp_port SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xdm_bind_vnc_tcp_port_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xdm_exec_bootloader_ocil:questionnaire:1">
      <title>Disable the xdm_exec_bootloader SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xdm_exec_bootloader_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xdm_sysadm_login_ocil:questionnaire:1">
      <title>Disable the xdm_sysadm_login SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xdm_sysadm_login_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xdm_write_home_ocil:questionnaire:1">
      <title>Disable the xdm_write_home SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xdm_write_home_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xend_run_blktap_ocil:questionnaire:1">
      <title>Enable the xend_run_blktap SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xend_run_blktap_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xend_run_qemu_ocil:questionnaire:1">
      <title>Enable the xend_run_qemu SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xend_run_qemu_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xen_use_nfs_ocil:questionnaire:1">
      <title>Disable the xen_use_nfs SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xen_use_nfs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xguest_connect_network_ocil:questionnaire:1">
      <title>Disable the xguest_connect_network SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xguest_connect_network_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xguest_exec_content_ocil:questionnaire:1">
      <title>Disable the xguest_exec_content SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xguest_exec_content_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xguest_mount_media_ocil:questionnaire:1">
      <title>Disable the xguest_mount_media SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xguest_mount_media_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xguest_use_bluetooth_ocil:questionnaire:1">
      <title>Disable the xguest_use_bluetooth SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xguest_use_bluetooth_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xserver_clients_write_xshm_ocil:questionnaire:1">
      <title>Disable the xserver_clients_write_xshm SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xserver_clients_write_xshm_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xserver_execmem_ocil:questionnaire:1">
      <title>Disable the xserver_execmem SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xserver_execmem_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_xserver_object_manager_ocil:questionnaire:1">
      <title>Disable the xserver_object_manager SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_xserver_object_manager_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_zabbix_can_network_ocil:questionnaire:1">
      <title>Disable the zabbix_can_network SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_zabbix_can_network_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_zarafa_setrlimit_ocil:questionnaire:1">
      <title>Disable the zarafa_setrlimit SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_zarafa_setrlimit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_zebra_write_config_ocil:questionnaire:1">
      <title>Disable the zebra_write_config SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_zebra_write_config_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_zoneminder_anon_write_ocil:questionnaire:1">
      <title>Disable the zoneminder_anon_write SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_zoneminder_anon_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sebool_zoneminder_run_sudo_ocil:questionnaire:1">
      <title>Disable the zoneminder_run_sudo SELinux Boolean</title>
      <actions>
        <test_action_ref>ocil:ssg-sebool_zoneminder_run_sudo_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-no_direct_root_logins_ocil:questionnaire:1">
      <title>Direct root Logins Not Allowed</title>
      <actions>
        <test_action_ref>ocil:ssg-no_direct_root_logins_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-securetty_root_login_console_only_ocil:questionnaire:1">
      <title>Restrict Virtual Console Root Logins</title>
      <actions>
        <test_action_ref>ocil:ssg-securetty_root_login_console_only_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-restrict_serial_port_logins_ocil:questionnaire:1">
      <title>Restrict Serial Port Root Logins</title>
      <actions>
        <test_action_ref>ocil:ssg-restrict_serial_port_logins_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-no_root_webbrowsing_ocil:questionnaire:1">
      <title>Restrict Web Browser Use for Administrative Accounts</title>
      <actions>
        <test_action_ref>ocil:ssg-no_root_webbrowsing_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-no_shelllogin_for_systemaccounts_ocil:questionnaire:1">
      <title>Ensure that System Accounts Do Not Run a Shell Upon Login</title>
      <actions>
        <test_action_ref>ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_no_uid_except_zero_ocil:questionnaire:1">
      <title>Verify Only Root Has UID 0</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_no_uid_except_zero_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-root_path_default_ocil:questionnaire:1">
      <title>Root Path Must Be Vendor Default</title>
      <actions>
        <test_action_ref>ocil:ssg-root_path_default_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-no_empty_passwords_ocil:questionnaire:1">
      <title>Prevent Log In to Accounts With Empty Password</title>
      <actions>
        <test_action_ref>ocil:ssg-no_empty_passwords_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_all_shadowed_ocil:questionnaire:1">
      <title>Verify All Account Password Hashes are Shadowed</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_all_shadowed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-gid_passwd_group_same_ocil:questionnaire:1">
      <title>All GIDs referenced in /etc/passwd must be defined in /etc/group</title>
      <actions>
        <test_action_ref>ocil:ssg-gid_passwd_group_same_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-no_netrc_files_ocil:questionnaire:1">
      <title>Verify No netrc Files Exist</title>
      <actions>
        <test_action_ref>ocil:ssg-no_netrc_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_minlen_login_defs_ocil:questionnaire:1">
      <title>Set Password Minimum Length in login.defs</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_minimum_age_login_defs_ocil:questionnaire:1">
      <title>Set Password Minimum Age</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_maximum_age_login_defs_ocil:questionnaire:1">
      <title>Set Password Maximum Age</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_warn_age_login_defs_ocil:questionnaire:1">
      <title>Set Password Warning Age</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-account_disable_post_pw_expiration_ocil:questionnaire:1">
      <title>Set Account Expiration Following Inactivity</title>
      <actions>
        <test_action_ref>ocil:ssg-account_disable_post_pw_expiration_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-account_unique_name_ocil:questionnaire:1">
      <title>Ensure All Accounts on the System Have Unique Names</title>
      <actions>
        <test_action_ref>ocil:ssg-account_unique_name_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-account_temp_expire_date_ocil:questionnaire:1">
      <title>Assign Expiration Date to Temporary Accounts</title>
      <actions>
        <test_action_ref>ocil:ssg-account_temp_expire_date_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-display_login_attempts_ocil:questionnaire:1">
      <title>Set Last Logon/Access Notification</title>
      <actions>
        <test_action_ref>ocil:ssg-display_login_attempts_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_retry_ocil:questionnaire:1">
      <title>Set Password Retry Prompts Permitted Per-Session</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_retry_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_maxrepeat_ocil:questionnaire:1">
      <title>Set Password Maximum Consecutive Repeating Characters</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_maxrepeat_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_maxclassrepeat_ocil:questionnaire:1">
      <title>Set Password to Maximum of Consecutive Repeating Characters from Same Character Class</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_maxclassrepeat_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_dcredit_ocil:questionnaire:1">
      <title>Set Password Strength Minimum Digit Characters</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_dcredit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_minlen_ocil:questionnaire:1">
      <title>Set Password Minimum Length</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_minlen_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1">
      <title>Set Password Strength Minimum Uppercase Characters</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_ucredit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_ocredit_ocil:questionnaire:1">
      <title>Set Password Strength Minimum Special Characters</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_ocredit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_lcredit_ocil:questionnaire:1">
      <title>Set Password Strength Minimum Lowercase Characters</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_lcredit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_difok_ocil:questionnaire:1">
      <title>Set Password Strength Minimum Different Characters</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_difok_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_minclass_ocil:questionnaire:1">
      <title>Set Password Strength Minimum Different Categories</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_minclass_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_deny_ocil:questionnaire:1">
      <title>Set Deny For Failed Password Attempts</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_deny_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_ocil:questionnaire:1">
      <title>Set Lockout Time For Failed Password Attempts</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_unlock_time_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_ocil:questionnaire:1">
      <title>Configure the root Account for Failed Password Attempts</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_deny_root_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_passwords_pam_faillock_interval_ocil:questionnaire:1">
      <title>Set Interval For Counting Failed Password Attempts</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_passwords_pam_faillock_interval_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_password_pam_unix_remember_ocil:questionnaire:1">
      <title>Limit Password Reuse</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_password_pam_unix_remember_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1">
      <title>Set PAM's Password Hashing Algorithm</title>
      <actions>
        <test_action_ref>ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-set_password_hashing_algorithm_logindefs_ocil:questionnaire:1">
      <title>Set Password Hashing Algorithm in /etc/login.defs</title>
      <actions>
        <test_action_ref>ocil:ssg-set_password_hashing_algorithm_logindefs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-set_password_hashing_algorithm_libuserconf_ocil:questionnaire:1">
      <title>Set Password Hashing Algorithm in /etc/libuser.conf</title>
      <actions>
        <test_action_ref>ocil:ssg-set_password_hashing_algorithm_libuserconf_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_tmout_ocil:questionnaire:1">
      <title>Set Interactive Session Timeout</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_tmout_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1">
      <title>Limit the Number of Concurrent Login Sessions Allowed Per User</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_logon_fail_delay_ocil:questionnaire:1">
      <title>Ensure the Logon Failure Delay is Set Correctly in login.defs</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_logon_fail_delay_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_root_path_dirs_no_write_ocil:questionnaire:1">
      <title>Ensure that Root's Path Does Not Include World or Group-Writable Directories</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_home_dirs_ocil:questionnaire:1">
      <title>Ensure that User Home Directories are not Group-Writable or World-Readable</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_home_dirs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_umask_etc_bashrc_ocil:questionnaire:1">
      <title>Ensure the Default Bash Umask is Set Correctly</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_umask_etc_bashrc_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_umask_etc_csh_cshrc_ocil:questionnaire:1">
      <title>Ensure the Default C Shell Umask is Set Correctly</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_umask_etc_csh_cshrc_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_umask_etc_profile_ocil:questionnaire:1">
      <title>Ensure the Default Umask is Set Correctly in /etc/profile</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_umask_etc_profile_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-accounts_umask_etc_login_defs_ocil:questionnaire:1">
      <title>Ensure the Default Umask is Set Correctly in login.defs</title>
      <actions>
        <test_action_ref>ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_user_owner_grub2_cfg_ocil:questionnaire:1">
      <title>Verify /boot/grub2/grub.cfg User Ownership</title>
      <actions>
        <test_action_ref>ocil:ssg-file_user_owner_grub2_cfg_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_group_owner_grub2_cfg_ocil:questionnaire:1">
      <title>Verify /boot/grub2/grub.cfg Group Ownership</title>
      <actions>
        <test_action_ref>ocil:ssg-file_group_owner_grub2_cfg_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_grub2_cfg_ocil:questionnaire:1">
      <title>Verify /boot/grub2/grub.cfg Permissions</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_grub2_cfg_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-bootloader_password_ocil:questionnaire:1">
      <title>Set Boot Loader Password</title>
      <actions>
        <test_action_ref>ocil:ssg-bootloader_password_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-bootloader_uefi_password_ocil:questionnaire:1">
      <title>Set the UEFI Boot Loader Password</title>
      <actions>
        <test_action_ref>ocil:ssg-bootloader_uefi_password_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-require_singleuser_auth_ocil:questionnaire:1">
      <title>Require Authentication for Single User Mode</title>
      <actions>
        <test_action_ref>ocil:ssg-require_singleuser_auth_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_debug-shell_disabled_ocil:questionnaire:1">
      <title>Disable debug-shell SystemD Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_debug-shell_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-disable_ctrlaltdel_reboot_ocil:questionnaire:1">
      <title>Disable Ctrl-Alt-Del Reboot Activation</title>
      <actions>
        <test_action_ref>ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-disable_interactive_boot_ocil:questionnaire:1">
      <title>Verify that Interactive Boot is Disabled</title>
      <actions>
        <test_action_ref>ocil:ssg-disable_interactive_boot_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_screen_installed_ocil:questionnaire:1">
      <title>Install the screen Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_screen_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-smartcard_auth_ocil:questionnaire:1">
      <title>Enable Smart Card Login</title>
      <actions>
        <test_action_ref>ocil:ssg-smartcard_auth_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-banner_etc_issue_ocil:questionnaire:1">
      <title>Modify the System Login Banner</title>
      <actions>
        <test_action_ref>ocil:ssg-banner_etc_issue_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_banner_enabled_ocil:questionnaire:1">
      <title>Enable GNOME3 Login Warning Banner</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_banner_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-dconf_gnome_login_banner_text_ocil:questionnaire:1">
      <title>Set the GNOME3 Login Warning Banner Text</title>
      <actions>
        <test_action_ref>ocil:ssg-dconf_gnome_login_banner_text_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-network_disable_ddns_interfaces_ocil:questionnaire:1">
      <title>Disable Client Dynamic DNS Updates</title>
      <actions>
        <test_action_ref>ocil:ssg-network_disable_ddns_interfaces_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-network_sniffer_disabled_ocil:questionnaire:1">
      <title>Ensure System is Not Acting as a Network Sniffer</title>
      <actions>
        <test_action_ref>ocil:ssg-network_sniffer_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_ocil:questionnaire:1">
      <title>Disable Kernel Parameter for Sending ICMP Redirects by Default</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_ocil:questionnaire:1">
      <title>Disable Kernel Parameter for Sending ICMP Redirects for All Interfaces</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_ip_forward_ocil:questionnaire:1">
      <title>Disable Kernel Parameter for IP Forwarding</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_ocil:questionnaire:1">
      <title>Configure Kernel Parameter for Accepting Source-Routed Packets for All Interfaces</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_ocil:questionnaire:1">
      <title>Configure Kernel Parameter for Accepting ICMP Redirects for All Interfaces</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_ocil:questionnaire:1">
      <title>Configure Kernel Parameter for Accepting Secure Redirects for All Interfaces</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_ocil:questionnaire:1">
      <title>Configure Kernel Parameter to Log Martian Packets</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_ocil:questionnaire:1">
      <title>Configure Kernel Parameter to Log Martian Packets By Default</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_ocil:questionnaire:1">
      <title>Configure Kernel Parameter for Accepting Source-Routed Packets By Default</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_ocil:questionnaire:1">
      <title>Configure Kernel Parameter for Accepting ICMP Redirects By Default</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_ocil:questionnaire:1">
      <title>Configure Kernel Parameter for Accepting Secure Redirects By Default</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_ocil:questionnaire:1">
      <title>Configure Kernel Parameter to Ignore ICMP Broadcast Echo Requests</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_ocil:questionnaire:1">
      <title>Configure Kernel Parameter to Ignore Bogus ICMP Error Responses</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_ocil:questionnaire:1">
      <title>Configure Kernel Parameter to Use TCP Syncookies</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_ocil:questionnaire:1">
      <title>Configure Kernel Parameter to Use Reverse Path Filtering for All Interfaces</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_ocil:questionnaire:1">
      <title>Configure Kernel Parameter to Use Reverse Path Filtering by Default</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_bluetooth_disabled_ocil:questionnaire:1">
      <title>Disable Bluetooth Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_bluetooth_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-kernel_module_bluetooth_disabled_ocil:questionnaire:1">
      <title>Disable Bluetooth Kernel Modules</title>
      <actions>
        <test_action_ref>ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_kernel_ipv6_disable_ocil:questionnaire:1">
      <title>Disable IPv6 Networking Support Automatic Loading</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_kernel_ipv6_disable_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_ocil:questionnaire:1">
      <title>Configure Kernel Parameter for Accepting Source-Routed Packets for All Interfaces</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_ocil:questionnaire:1">
      <title>Configure Accepting IPv6 Router Advertisements</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_ocil:questionnaire:1">
      <title>Configure Accepting IPv6 Router Advertisements</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1">
      <title>Configure Accepting IPv6 Redirects By Default</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_ocil:questionnaire:1">
      <title>Configure Accepting IPv6 Redirects By Default</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_ocil:questionnaire:1">
      <title>Configure Kernel Parameter for Accepting Source-Routed Packets for Interfaces By Default</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_ocil:questionnaire:1">
      <title>Disable Kernel Parameter for IPv6 Forwarding</title>
      <actions>
        <test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_firewalld_enabled_ocil:questionnaire:1">
      <title>Verify firewalld Enabled</title>
      <actions>
        <test_action_ref>ocil:ssg-service_firewalld_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-set_firewalld_default_zone_ocil:questionnaire:1">
      <title>Set Default firewalld Zone for Incoming Packets</title>
      <actions>
        <test_action_ref>ocil:ssg-set_firewalld_default_zone_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-kernel_module_dccp_disabled_ocil:questionnaire:1">
      <title>Disable DCCP Support</title>
      <actions>
        <test_action_ref>ocil:ssg-kernel_module_dccp_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-kernel_module_sctp_disabled_ocil:questionnaire:1">
      <title>Disable SCTP Support</title>
      <actions>
        <test_action_ref>ocil:ssg-kernel_module_sctp_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_libreswan_installed_ocil:questionnaire:1">
      <title>Install libreswan Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_libreswan_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-libreswan_approved_tunnels_ocil:questionnaire:1">
      <title>Verify Any Configured IPSec Tunnel Connections</title>
      <actions>
        <test_action_ref>ocil:ssg-libreswan_approved_tunnels_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_rsyslog_installed_ocil:questionnaire:1">
      <title>Ensure rsyslog is Installed</title>
      <actions>
        <test_action_ref>ocil:ssg-package_rsyslog_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_rsyslog_enabled_ocil:questionnaire:1">
      <title>Enable rsyslog Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_rsyslog_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rsyslog_files_ownership_ocil:questionnaire:1">
      <title>Ensure Log Files Are Owned By Appropriate User</title>
      <actions>
        <test_action_ref>ocil:ssg-rsyslog_files_ownership_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rsyslog_files_groupownership_ocil:questionnaire:1">
      <title>Ensure Log Files Are Owned By Appropriate Group</title>
      <actions>
        <test_action_ref>ocil:ssg-rsyslog_files_groupownership_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rsyslog_files_permissions_ocil:questionnaire:1">
      <title>Ensure System Log Files Have Correct Permissions</title>
      <actions>
        <test_action_ref>ocil:ssg-rsyslog_files_permissions_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rsyslog_cron_logging_ocil:questionnaire:1">
      <title>Ensure cron Is Logging To Rsyslog</title>
      <actions>
        <test_action_ref>ocil:ssg-rsyslog_cron_logging_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-rsyslog_remote_loghost_ocil:questionnaire:1">
      <title>Ensure Logs Sent To Remote Host</title>
      <actions>
        <test_action_ref>ocil:ssg-rsyslog_remote_loghost_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ensure_logrotate_activated_ocil:questionnaire:1">
      <title>Ensure Logrotate Runs Periodically</title>
      <actions>
        <test_action_ref>ocil:ssg-ensure_logrotate_activated_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_auditd_enabled_ocil:questionnaire:1">
      <title>Enable auditd Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_auditd_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-bootloader_audit_argument_ocil:questionnaire:1">
      <title>Enable Auditing for Processes Which Start Prior to the Audit Daemon</title>
      <actions>
        <test_action_ref>ocil:ssg-bootloader_audit_argument_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-auditd_data_retention_num_logs_ocil:questionnaire:1">
      <title>Configure auditd Number of Logs Retained</title>
      <actions>
        <test_action_ref>ocil:ssg-auditd_data_retention_num_logs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-auditd_data_retention_max_log_file_ocil:questionnaire:1">
      <title>Configure auditd Max Log File Size</title>
      <actions>
        <test_action_ref>ocil:ssg-auditd_data_retention_max_log_file_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-auditd_data_retention_max_log_file_action_ocil:questionnaire:1">
      <title>Configure auditd max_log_file_action Upon Reaching Maximum Log Size</title>
      <actions>
        <test_action_ref>ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-auditd_data_retention_space_left_action_ocil:questionnaire:1">
      <title>Configure auditd space_left Action on Low Disk Space</title>
      <actions>
        <test_action_ref>ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-auditd_data_retention_admin_space_left_action_ocil:questionnaire:1">
      <title>Configure auditd admin_space_left Action on Low Disk Space</title>
      <actions>
        <test_action_ref>ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-auditd_data_retention_action_mail_acct_ocil:questionnaire:1">
      <title>Configure auditd mail_acct Action on Low Disk Space</title>
      <actions>
        <test_action_ref>ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-auditd_data_retention_flush_ocil:questionnaire:1">
      <title>Configure auditd flush priority</title>
      <actions>
        <test_action_ref>ocil:ssg-auditd_data_retention_flush_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-auditd_audispd_syslog_plugin_activated_ocil:questionnaire:1">
      <title>Configure auditd to use audispd's syslog plugin</title>
      <actions>
        <test_action_ref>ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_time_adjtimex_ocil:questionnaire:1">
      <title>Record attempts to alter time through adjtimex</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_time_adjtimex_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_time_settimeofday_ocil:questionnaire:1">
      <title>Record attempts to alter time through settimeofday</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_time_settimeofday_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_time_stime_ocil:questionnaire:1">
      <title>Record Attempts to Alter Time Through stime</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_time_stime_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_time_clock_settime_ocil:questionnaire:1">
      <title>Record Attempts to Alter Time Through clock_settime</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_time_clock_settime_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_time_watch_localtime_ocil:questionnaire:1">
      <title>Record Attempts to Alter the localtime File</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1">
      <title>Record Events that Modify User/Group Information</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_networkconfig_modification_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Network Environment</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_var_log_audit_ocil:questionnaire:1">
      <title>System Audit Logs Must Have Mode 0640 or Less Permissive</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_var_log_audit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_ownership_var_log_audit_ocil:questionnaire:1">
      <title>System Audit Logs Must Be Owned By Root</title>
      <actions>
        <test_action_ref>ocil:ssg-file_ownership_var_log_audit_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_mac_modification_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Mandatory Access Controls</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_mac_modification_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_chmod_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - chmod</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_chown_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - chown</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - fchmod</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_fchmodat_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - fchmodat</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_fchown_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - fchown</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_fchownat_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - fchownat</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_fremovexattr_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - fremovexattr</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_fsetxattr_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - fsetxattr</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_lchown_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - lchown</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_lremovexattr_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - lremovexattr</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_lsetxattr_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - lsetxattr</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_removexattr_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - removexattr</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_dac_modification_setxattr_ocil:questionnaire:1">
      <title>Record Events that Modify the System's Discretionary Access Controls - setxattr</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1">
      <title>Ensure auditd Collects Unauthorized Access Attempts to Files (unsuccessful)</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_privileged_commands_ocil:questionnaire:1">
      <title>Ensure auditd Collects Information on the Use of Privileged Commands</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_privileged_commands_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_media_export_ocil:questionnaire:1">
      <title>Ensure auditd Collects Information on Exporting to Media (successful)</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_media_export_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_file_deletion_events_ocil:questionnaire:1">
      <title>Ensure auditd Collects File Deletion Events by User</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_file_deletion_events_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_sysadmin_actions_ocil:questionnaire:1">
      <title>Ensure auditd Collects System Administrator Actions</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-audit_rules_kernel_module_loading_ocil:questionnaire:1">
      <title>Ensure auditd Collects Information on Kernel Module Loading and Unloading</title>
      <actions>
        <test_action_ref>ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_xinetd_disabled_ocil:questionnaire:1">
      <title>Disable xinetd Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_xinetd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_xinetd_removed_ocil:questionnaire:1">
      <title>Uninstall xinetd Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_xinetd_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_tcp_wrappers_installed_ocil:questionnaire:1">
      <title>Install tcp_wrappers Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_tcp_wrappers_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_telnet_disabled_ocil:questionnaire:1">
      <title>Disable telnet Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_telnet_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_telnet-server_removed_ocil:questionnaire:1">
      <title>Uninstall telnet-server Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_telnet-server_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_telnet_removed_ocil:questionnaire:1">
      <title>Remove telnet Clients</title>
      <actions>
        <test_action_ref>ocil:ssg-package_telnet_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_rsh-server_removed_ocil:questionnaire:1">
      <title>Uninstall rsh-server Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_rsh-server_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_rexec_disabled_ocil:questionnaire:1">
      <title>Disable rexec Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_rexec_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_rsh_disabled_ocil:questionnaire:1">
      <title>Disable rsh Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_rsh_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_rsh_removed_ocil:questionnaire:1">
      <title>Uninstall rsh Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_rsh_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_rlogin_disabled_ocil:questionnaire:1">
      <title>Disable rlogin Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_rlogin_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1">
      <title>Remove Rsh Trust Files</title>
      <actions>
        <test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_ypserv_removed_ocil:questionnaire:1">
      <title>Uninstall ypserv Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_ypserv_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_ypbind_disabled_ocil:questionnaire:1">
      <title>Disable ypbind Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_ypbind_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_ypbind_removed_ocil:questionnaire:1">
      <title>Remove NIS Client</title>
      <actions>
        <test_action_ref>ocil:ssg-package_ypbind_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_tftp_disabled_ocil:questionnaire:1">
      <title>Disable tftp Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_tftp_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_tftp-server_removed_ocil:questionnaire:1">
      <title>Uninstall tftp-server Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_tftp-server_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_tftp_removed_ocil:questionnaire:1">
      <title>Remove tftp Daemon</title>
      <actions>
        <test_action_ref>ocil:ssg-package_tftp_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-tftpd_uses_secure_mode_ocil:questionnaire:1">
      <title>Ensure tftp Daemon Uses Secure Mode</title>
      <actions>
        <test_action_ref>ocil:ssg-tftpd_uses_secure_mode_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_talk-server_removed_ocil:questionnaire:1">
      <title>Uninstall talk-server Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_talk-server_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_talk_removed_ocil:questionnaire:1">
      <title>Uninstall talk Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_talk_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_abrtd_disabled_ocil:questionnaire:1">
      <title>Disable Automatic Bug Reporting Tool (abrtd)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_abrtd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_acpid_disabled_ocil:questionnaire:1">
      <title>Disable Advanced Configuration and Power Interface (acpid)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_acpid_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_certmonger_disabled_ocil:questionnaire:1">
      <title>Disable Certmonger Service (certmonger)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_certmonger_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_cgconfig_disabled_ocil:questionnaire:1">
      <title>Disable Control Group Config (cgconfig)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_cgconfig_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_cgred_disabled_ocil:questionnaire:1">
      <title>Disable Control Group Rules Engine (cgred)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_cgred_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_cpupower_disabled_ocil:questionnaire:1">
      <title>Disable CPU Speed (cpupower)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_cpupower_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_irqbalance_enabled_ocil:questionnaire:1">
      <title>Enable IRQ Balance (irqbalance)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_irqbalance_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_kdump_disabled_ocil:questionnaire:1">
      <title>Disable KDump Kernel Crash Analyzer (kdump)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_kdump_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_mdmonitor_disabled_ocil:questionnaire:1">
      <title>Disable Software RAID Monitor (mdmonitor)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_mdmonitor_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_messagebus_disabled_ocil:questionnaire:1">
      <title>Disable D-Bus IPC Service (messagebus)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_messagebus_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_netconsole_disabled_ocil:questionnaire:1">
      <title>Disable Network Console (netconsole)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_netconsole_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_ntpdate_disabled_ocil:questionnaire:1">
      <title>Disable ntpdate Service (ntpdate)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_ntpdate_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_oddjobd_disabled_ocil:questionnaire:1">
      <title>Disable Odd Job Daemon (oddjobd)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_oddjobd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_portreserve_disabled_ocil:questionnaire:1">
      <title>Disable Portreserve (portreserve)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_portreserve_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_psacct_enabled_ocil:questionnaire:1">
      <title>Enable Process Accounting (psacct)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_psacct_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_qpidd_disabled_ocil:questionnaire:1">
      <title>Disable Apache Qpid (qpidd)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_qpidd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_quota_nld_disabled_ocil:questionnaire:1">
      <title>Disable Quota Netlink (quota_nld)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_quota_nld_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_rdisc_disabled_ocil:questionnaire:1">
      <title>Disable Network Router Discovery Daemon (rdisc)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_rdisc_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_rhnsd_disabled_ocil:questionnaire:1">
      <title>Disable Red Hat Network Service (rhnsd)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_rhnsd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_rhsmcertd_disabled_ocil:questionnaire:1">
      <title>Disable Red Hat Subscription Manager Daemon (rhsmcertd)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_rhsmcertd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_saslauthd_disabled_ocil:questionnaire:1">
      <title>Disable Cyrus SASL Authentication Daemon (saslauthd)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_saslauthd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_smartd_disabled_ocil:questionnaire:1">
      <title>Disable SMART Disk Monitoring Service (smartd)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_smartd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_sysstat_disabled_ocil:questionnaire:1">
      <title>Disable System Statistics Reset Service (sysstat)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_sysstat_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_crond_enabled_ocil:questionnaire:1">
      <title>Enable cron Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_crond_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-disable_anacron_ocil:questionnaire:1">
      <title>Disable anacron Service</title>
      <actions>
        <test_action_ref>ocil:ssg-disable_anacron_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_atd_disabled_ocil:questionnaire:1">
      <title>Disable At Service (atd)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_atd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_owner_cron_allow_ocil:questionnaire:1">
      <title>Verify User Who Owns /etc/cron.allow file</title>
      <actions>
        <test_action_ref>ocil:ssg-file_owner_cron_allow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_groupowner_cron_allow_ocil:questionnaire:1">
      <title>Verify Group Who Owns /etc/cron.allow file</title>
      <actions>
        <test_action_ref>ocil:ssg-file_groupowner_cron_allow_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_docker_enabled_ocil:questionnaire:1">
      <title>Enable the Docker service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_docker_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_openssh-server_installed_ocil:questionnaire:1">
      <title>Install the OpenSSH Server Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_openssh-server_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_sshd_enabled_ocil:questionnaire:1">
      <title>Enable the OpenSSH Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_sshd_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1">
      <title>Verify Permissions on SSH Server Public *.pub Key Files</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-file_permissions_sshd_private_key_ocil:questionnaire:1">
      <title>Verify Permissions on SSH Server Private *_key Key Files</title>
      <actions>
        <test_action_ref>ocil:ssg-file_permissions_sshd_private_key_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-firewalld_sshd_port_enabled_ocil:questionnaire:1">
      <title>Enable SSH Server firewalld Firewall exception</title>
      <actions>
        <test_action_ref>ocil:ssg-firewalld_sshd_port_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1">
      <title>Allow Only SSH Protocol 2</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_disable_gssapi_auth_ocil:questionnaire:1">
      <title>Disable GSSAPI Authentication</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_disable_kerb_auth_ocil:questionnaire:1">
      <title>Disable Kerberos Authentication</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_enable_strictmodes_ocil:questionnaire:1">
      <title>Enable Use of Strict Mode Checking</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_enable_strictmodes_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_use_priv_separation_ocil:questionnaire:1">
      <title>Enable Use of Privilege Separation</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_use_priv_separation_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_disable_compression_ocil:questionnaire:1">
      <title>Disable Compression Or Set Compression to delayed</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_disable_compression_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_print_last_log_ocil:questionnaire:1">
      <title>Print Last Log</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_print_last_log_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_set_idle_timeout_ocil:questionnaire:1">
      <title>Set SSH Idle Timeout Interval</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_set_idle_timeout_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_set_keepalive_ocil:questionnaire:1">
      <title>Set SSH Client Alive Count</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_set_keepalive_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_disable_rhosts_ocil:questionnaire:1">
      <title>Disable SSH Support for .rhosts Files</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_disable_rhosts_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_disable_user_known_hosts_ocil:questionnaire:1">
      <title>Disable SSH Support for User Known Hosts</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_disable_rhosts_rsa_ocil:questionnaire:1">
      <title>Disable SSH Support for Rhosts RSA Authentication</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-disable_host_auth_ocil:questionnaire:1">
      <title>Disable Host-Based Authentication</title>
      <actions>
        <test_action_ref>ocil:ssg-disable_host_auth_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-enable_x11_forwarding_ocil:questionnaire:1">
      <title>Enable Encrypted X11 Fordwarding</title>
      <actions>
        <test_action_ref>ocil:ssg-enable_x11_forwarding_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_disable_root_login_ocil:questionnaire:1">
      <title>Disable SSH Root Login</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_disable_root_login_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_disable_empty_passwords_ocil:questionnaire:1">
      <title>Disable SSH Access via Empty Passwords</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_disable_empty_passwords_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1">
      <title>Enable SSH Warning Banner</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_enable_warning_banner_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_do_not_permit_user_env_ocil:questionnaire:1">
      <title>Do Not Allow SSH Environment Options</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_use_approved_ciphers_ocil:questionnaire:1">
      <title>Use Only Approved Ciphers</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_use_approved_ciphers_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sshd_use_approved_macs_ocil:questionnaire:1">
      <title>Use Only FIPS Approved MACs</title>
      <actions>
        <test_action_ref>ocil:ssg-sshd_use_approved_macs_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_sssd_installed_ocil:questionnaire:1">
      <title>Install the SSSD Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_sssd_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_sssd_enabled_ocil:questionnaire:1">
      <title>Enable the SSSD Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_sssd_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sssd_memcache_timeout_ocil:questionnaire:1">
      <title>Configure SSSD's Memory Cache to Expire</title>
      <actions>
        <test_action_ref>ocil:ssg-sssd_memcache_timeout_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sssd_offline_cred_expiration_ocil:questionnaire:1">
      <title>Configure SSSD to Expire Offline Credentials</title>
      <actions>
        <test_action_ref>ocil:ssg-sssd_offline_cred_expiration_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sssd_ssh_known_hosts_timeout_ocil:questionnaire:1">
      <title>Configure SSSD to Expire SSH Known Hosts</title>
      <actions>
        <test_action_ref>ocil:ssg-sssd_ssh_known_hosts_timeout_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-xwindows_runlevel_setting_ocil:questionnaire:1">
      <title>Disable X Windows Startup By Setting Default Target</title>
      <actions>
        <test_action_ref>ocil:ssg-xwindows_runlevel_setting_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_xorg-x11-server-common_removed_ocil:questionnaire:1">
      <title>Remove the X Windows Package Group</title>
      <actions>
        <test_action_ref>ocil:ssg-package_xorg-x11-server-common_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_avahi-daemon_disabled_ocil:questionnaire:1">
      <title>Disable Avahi Server Software</title>
      <actions>
        <test_action_ref>ocil:ssg-service_avahi-daemon_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_cups_disabled_ocil:questionnaire:1">
      <title>Disable the CUPS Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_cups_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_dhcpd_disabled_ocil:questionnaire:1">
      <title>Disable DHCP Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_dhcpd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_dhcp_removed_ocil:questionnaire:1">
      <title>Uninstall DHCP Server Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_dhcp_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-sysconfig_networking_bootproto_ifcfg_ocil:questionnaire:1">
      <title>Disable DHCP Client</title>
      <actions>
        <test_action_ref>ocil:ssg-sysconfig_networking_bootproto_ifcfg_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_chronyd_or_ntpd_enabled_ocil:questionnaire:1">
      <title>Enable the NTP Daemon</title>
      <actions>
        <test_action_ref>ocil:ssg-service_chronyd_or_ntpd_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-chronyd_or_ntpd_specify_remote_server_ocil:questionnaire:1">
      <title>Specify a Remote NTP Server</title>
      <actions>
        <test_action_ref>ocil:ssg-chronyd_or_ntpd_specify_remote_server_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_postfix_enabled_ocil:questionnaire:1">
      <title>Enable Postfix Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_postfix_enabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_sendmail_removed_ocil:questionnaire:1">
      <title>Uninstall Sendmail Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_sendmail_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-postfix_network_listening_disabled_ocil:questionnaire:1">
      <title>Disable Postfix Network Listening</title>
      <actions>
        <test_action_ref>ocil:ssg-postfix_network_listening_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ldap_client_start_tls_ocil:questionnaire:1">
      <title>Configure LDAP Client to Use TLS For All Transactions</title>
      <actions>
        <test_action_ref>ocil:ssg-ldap_client_start_tls_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ldap_client_tls_cacertpath_ocil:questionnaire:1">
      <title>Configure Certificate Directives for LDAP Use of TLS</title>
      <actions>
        <test_action_ref>ocil:ssg-ldap_client_tls_cacertpath_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_openldap-servers_removed_ocil:questionnaire:1">
      <title>Uninstall openldap-servers Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_openldap-servers_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-nfs_no_anonymous_ocil:questionnaire:1">
      <title>Specify UID and GID for Anonymous NFS Connections</title>
      <actions>
        <test_action_ref>ocil:ssg-nfs_no_anonymous_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_nfs_disabled_ocil:questionnaire:1">
      <title>Disable Network File System (nfs)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_nfs_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_rpcsvcgssd_disabled_ocil:questionnaire:1">
      <title>Disable Secure RPC Server Service (rpcsvcgssd)</title>
      <actions>
        <test_action_ref>ocil:ssg-service_rpcsvcgssd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-mount_option_nodev_remote_filesystems_ocil:questionnaire:1">
      <title>Mount Remote Filesystems with nodev</title>
      <actions>
        <test_action_ref>ocil:ssg-mount_option_nodev_remote_filesystems_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-mount_option_nosuid_remote_filesystems_ocil:questionnaire:1">
      <title>Mount Remote Filesystems with nosuid</title>
      <actions>
        <test_action_ref>ocil:ssg-mount_option_nosuid_remote_filesystems_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-mount_option_krb_sec_remote_filesystems_ocil:questionnaire:1">
      <title>Mount Remote Filesystems with Kerberos Security</title>
      <actions>
        <test_action_ref>ocil:ssg-mount_option_krb_sec_remote_filesystems_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-no_insecure_locks_exports_ocil:questionnaire:1">
      <title>Ensure Insecure File Locking is Not Allowed</title>
      <actions>
        <test_action_ref>ocil:ssg-no_insecure_locks_exports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-use_kerberos_security_all_exports_ocil:questionnaire:1">
      <title>Use Kerberos Security on All Exports</title>
      <actions>
        <test_action_ref>ocil:ssg-use_kerberos_security_all_exports_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_named_disabled_ocil:questionnaire:1">
      <title>Disable DNS Server</title>
      <actions>
        <test_action_ref>ocil:ssg-service_named_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_bind_removed_ocil:questionnaire:1">
      <title>Uninstall bind Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_bind_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_vsftpd_disabled_ocil:questionnaire:1">
      <title>Disable vsftpd Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_vsftpd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1">
      <title>Uninstall vsftpd Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_vsftpd_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ftp_log_transactions_ocil:questionnaire:1">
      <title>Enable Logging of All FTP Transactions</title>
      <actions>
        <test_action_ref>ocil:ssg-ftp_log_transactions_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-ftp_present_banner_ocil:questionnaire:1">
      <title>Create Warning Banners for All FTP Users</title>
      <actions>
        <test_action_ref>ocil:ssg-ftp_present_banner_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_httpd_disabled_ocil:questionnaire:1">
      <title>Disable httpd Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_httpd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_httpd_removed_ocil:questionnaire:1">
      <title>Uninstall httpd Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_httpd_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_dovecot_disabled_ocil:questionnaire:1">
      <title>Disable Dovecot Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_dovecot_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_dovecot_removed_ocil:questionnaire:1">
      <title>Uninstall dovecot Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_dovecot_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_zebra_disabled_ocil:questionnaire:1">
      <title>Disable Quagga Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_zebra_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_quagga_removed_ocil:questionnaire:1">
      <title>Uninstall quagga Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_quagga_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_smb_disabled_ocil:questionnaire:1">
      <title>Disable Samba</title>
      <actions>
        <test_action_ref>ocil:ssg-service_smb_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_samba_removed_ocil:questionnaire:1">
      <title>Uninstall Samba Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_samba_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_samba-common_installed_ocil:questionnaire:1">
      <title>Install the Samba Common Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_samba-common_installed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-require_smb_client_signing_ocil:questionnaire:1">
      <title>Require Client SMB Packet Signing, if using smbclient</title>
      <actions>
        <test_action_ref>ocil:ssg-require_smb_client_signing_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-mount_option_smb_client_signing_ocil:questionnaire:1">
      <title>Require Client SMB Packet Signing, if using mount.cifs</title>
      <actions>
        <test_action_ref>ocil:ssg-mount_option_smb_client_signing_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_squid_disabled_ocil:questionnaire:1">
      <title>Disable Squid</title>
      <actions>
        <test_action_ref>ocil:ssg-service_squid_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_squid_removed_ocil:questionnaire:1">
      <title>Uninstall squid Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_squid_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-service_snmpd_disabled_ocil:questionnaire:1">
      <title>Disable snmpd Service</title>
      <actions>
        <test_action_ref>ocil:ssg-service_snmpd_disabled_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-package_net-snmp_removed_ocil:questionnaire:1">
      <title>Uninstall net-snmp Package</title>
      <actions>
        <test_action_ref>ocil:ssg-package_net-snmp_removed_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-snmpd_use_newer_protocol_ocil:questionnaire:1">
      <title>Configure SNMP Service to Use Only SNMPv3 or Newer </title>
      <actions>
        <test_action_ref>ocil:ssg-snmpd_use_newer_protocol_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-snmpd_not_default_password_ocil:questionnaire:1">
      <title>Ensure Default SNMP Password Is Not Used</title>
      <actions>
        <test_action_ref>ocil:ssg-snmpd_not_default_password_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-met_inherently_generic_ocil:questionnaire:1">
      <title>Product Meets this Requirement</title>
      <actions>
        <test_action_ref>ocil:ssg-met_inherently_generic_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-met_inherently_auditing_ocil:questionnaire:1">
      <title>Product Meets this Requirement</title>
      <actions>
        <test_action_ref>ocil:ssg-met_inherently_auditing_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-met_inherently_nonselected_ocil:questionnaire:1">
      <title>Product Meets this Requirement</title>
      <actions>
        <test_action_ref>ocil:ssg-met_inherently_nonselected_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-unmet_nonfinding_nonselected_scope_ocil:questionnaire:1">
      <title>Guidance Does Not Meet this Requirement Due to Impracticality or Scope</title>
      <actions>
        <test_action_ref>ocil:ssg-unmet_nonfinding_nonselected_scope_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-unmet_finding_nonselected_ocil:questionnaire:1">
      <title>Implementation of the Requirement is Not Supported</title>
      <actions>
        <test_action_ref>ocil:ssg-unmet_finding_nonselected_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-unmet_nonfinding_scope_ocil:questionnaire:1">
      <title>Guidance Does Not Meet this Requirement Due to Impracticality or Scope</title>
      <actions>
        <test_action_ref>ocil:ssg-unmet_nonfinding_scope_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-update_process_ocil:questionnaire:1">
      <title>A process for prompt installation of OS updates must exist.</title>
      <actions>
        <test_action_ref>ocil:ssg-update_process_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-c2s_procedural_requirement_ocil:questionnaire:1">
      <title>Procedural Requirement</title>
      <actions>
        <test_action_ref>ocil:ssg-c2s_procedural_requirement_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
    <questionnaire id="ocil:ssg-c2s_met_inherently_ocil:questionnaire:1">
      <title>Product Meets this Requirement</title>
      <actions>
        <test_action_ref>ocil:ssg-c2s_met_inherently_action:testaction:1</test_action_ref>
      </actions>
    </questionnaire>
  </questionnaires>
  <test_actions>
    <boolean_question_test_action id="ocil:ssg-partition_for_tmp_action:testaction:1" question_ref="ocil:ssg-partition_for_tmp_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-partition_for_var_action:testaction:1" question_ref="ocil:ssg-partition_for_var_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-partition_for_var_log_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-partition_for_var_log_audit_action:testaction:1" question_ref="ocil:ssg-partition_for_var_log_audit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-partition_for_home_action:testaction:1" question_ref="ocil:ssg-partition_for_home_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-encrypt_partitions_action:testaction:1" question_ref="ocil:ssg-encrypt_partitions_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ensure_redhat_gpgkey_installed_action:testaction:1" question_ref="ocil:ssg-ensure_redhat_gpgkey_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_globally_activated_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_globally_activated_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_never_disabled_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_never_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-security_patches_up_to_date_action:testaction:1" question_ref="ocil:ssg-security_patches_up_to_date_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-clean_components_post_updating_action:testaction:1" question_ref="ocil:ssg-clean_components_post_updating_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_local_packages_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_local_packages_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ensure_gpgcheck_repo_metadata_action:testaction:1" question_ref="ocil:ssg-ensure_gpgcheck_repo_metadata_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_aide_installed_action:testaction:1" question_ref="ocil:ssg-package_aide_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-aide_build_database_action:testaction:1" question_ref="ocil:ssg-aide_build_database_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-aide_periodic_cron_checking_action:testaction:1" question_ref="ocil:ssg-aide_periodic_cron_checking_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-aide_scan_notification_action:testaction:1" question_ref="ocil:ssg-aide_scan_notification_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-aide_verify_acls_action:testaction:1" question_ref="ocil:ssg-aide_verify_acls_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-aide_verify_ext_attributes_action:testaction:1" question_ref="ocil:ssg-aide_verify_ext_attributes_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-aide_use_fips_hashes_action:testaction:1" question_ref="ocil:ssg-aide_use_fips_hashes_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rpm_verify_permissions_action:testaction:1" question_ref="ocil:ssg-rpm_verify_permissions_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rpm_verify_hashes_action:testaction:1" question_ref="ocil:ssg-rpm_verify_hashes_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-install_hids_action:testaction:1" question_ref="ocil:ssg-install_hids_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-install_antivirus_action:testaction:1" question_ref="ocil:ssg-install_antivirus_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-install_mcafee_cma_rt_action:testaction:1" question_ref="ocil:ssg-install_mcafee_cma_rt_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-install_mcafee_hbss_hips_action:testaction:1" question_ref="ocil:ssg-install_mcafee_hbss_hips_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-install_mcafee_hbss_accm_action:testaction:1" question_ref="ocil:ssg-install_mcafee_hbss_accm_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-install_mcafee_hbss_pa_action:testaction:1" question_ref="ocil:ssg-install_mcafee_hbss_pa_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-install_mcafee_antivirus_action:testaction:1" question_ref="ocil:ssg-install_mcafee_antivirus_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_nails_enabled_action:testaction:1" question_ref="ocil:ssg-service_nails_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-mcafee_antivirus_definitions_updated_action:testaction:1" question_ref="ocil:ssg-mcafee_antivirus_definitions_updated_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_dracut-fips_installed_action:testaction:1" question_ref="ocil:ssg-package_dracut-fips_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-grub2_enable_fips_mode_action:testaction:1" question_ref="ocil:ssg-grub2_enable_fips_mode_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-installed_OS_is_certified_action:testaction:1" question_ref="ocil:ssg-installed_OS_is_certified_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-enable_dconf_user_profile_action:testaction:1" question_ref="ocil:ssg-enable_dconf_user_profile_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_automatic_login_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_automatic_login_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-gnome_gdm_disable_guest_login_action:testaction:1" question_ref="ocil:ssg-gnome_gdm_disable_guest_login_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_user_list_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_user_list_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_restart_shutdown_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_restart_shutdown_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_enable_smartcard_auth_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_enable_smartcard_auth_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_login_retries_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_login_retries_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_idle_delay_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_idle_delay_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_lock_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_lock_delay_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_lock_delay_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_mode_blank_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_mode_blank_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_screensaver_user_info_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_screensaver_user_info_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_session_user_locks_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_session_user_locks_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_user_admin_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_user_admin_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_power_settings_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_power_settings_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_geolocation_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_geolocation_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_wifi_create_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_wifi_create_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_wifi_notification_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_wifi_notification_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_remote_access_credential_prompt_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_remote_access_encryption_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_remote_access_encryption_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_automount_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_automount_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_disable_thumbnailers_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_disable_thumbnailers_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sudo_remove_nopasswd_action:testaction:1" question_ref="ocil:ssg-sudo_remove_nopasswd_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sudo_remove_no_authenticate_action:testaction:1" question_ref="ocil:ssg-sudo_remove_no_authenticate_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-mount_option_noexec_removable_partitions_action:testaction:1" question_ref="ocil:ssg-mount_option_noexec_removable_partitions_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-kernel_module_usb-storage_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_usb-storage_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_autofs_disabled_action:testaction:1" question_ref="ocil:ssg-service_autofs_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-userowner_shadow_file_action:testaction:1" question_ref="ocil:ssg-userowner_shadow_file_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-groupowner_shadow_file_action:testaction:1" question_ref="ocil:ssg-groupowner_shadow_file_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_etc_shadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_shadow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_owner_etc_group_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_group_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_groupowner_etc_group_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_group_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_etc_group_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_group_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_owner_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_gshadow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_groupowner_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_gshadow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_etc_gshadow_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_owner_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_owner_etc_passwd_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_groupowner_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_groupowner_etc_passwd_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_etc_passwd_action:testaction:1" question_ref="ocil:ssg-file_permissions_etc_passwd_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_library_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_library_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_ownership_library_dirs_action:testaction:1" question_ref="ocil:ssg-file_ownership_library_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_binary_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_binary_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_ownership_binary_dirs_action:testaction:1" question_ref="ocil:ssg-file_ownership_binary_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_sticky_bits_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_sticky_bits_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_world_writable_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_world_writable_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_sgid_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_sgid_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_unauthorized_suid_action:testaction:1" question_ref="ocil:ssg-file_permissions_unauthorized_suid_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-no_files_unowned_by_user_action:testaction:1" question_ref="ocil:ssg-no_files_unowned_by_user_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_ungroupowned_action:testaction:1" question_ref="ocil:ssg-file_permissions_ungroupowned_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dir_perms_world_writable_system_owned_action:testaction:1" question_ref="ocil:ssg-dir_perms_world_writable_system_owned_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-umask_for_daemons_action:testaction:1" question_ref="ocil:ssg-umask_for_daemons_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-disable_users_coredumps_action:testaction:1" question_ref="ocil:ssg-disable_users_coredumps_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_fs_suid_dumpable_action:testaction:1" question_ref="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_kernel_exec_shield_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_exec_shield_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_kernel_randomize_va_space_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_kernel_dmesg_restrict_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_dmesg_restrict_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-enable_selinux_bootloader_action:testaction:1" question_ref="ocil:ssg-enable_selinux_bootloader_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-selinux_state_action:testaction:1" question_ref="ocil:ssg-selinux_state_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-selinux_policytype_action:testaction:1" question_ref="ocil:ssg-selinux_policytype_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-selinux_all_devicefiles_labeled_action:testaction:1" question_ref="ocil:ssg-selinux_all_devicefiles_labeled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_abrt_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_abrt_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_abrt_handle_event_action:testaction:1" question_ref="ocil:ssg-sebool_abrt_handle_event_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_abrt_upload_watch_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_abrt_upload_watch_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_antivirus_can_scan_system_action:testaction:1" question_ref="ocil:ssg-sebool_antivirus_can_scan_system_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_antivirus_use_jit_action:testaction:1" question_ref="ocil:ssg-sebool_antivirus_use_jit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_auditadm_exec_content_action:testaction:1" question_ref="ocil:ssg-sebool_auditadm_exec_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_authlogin_nsswitch_use_ldap_action:testaction:1" question_ref="ocil:ssg-sebool_authlogin_nsswitch_use_ldap_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_authlogin_radius_action:testaction:1" question_ref="ocil:ssg-sebool_authlogin_radius_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_authlogin_yubikey_action:testaction:1" question_ref="ocil:ssg-sebool_authlogin_yubikey_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_awstats_purge_apache_log_files_action:testaction:1" question_ref="ocil:ssg-sebool_awstats_purge_apache_log_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_boinc_execmem_action:testaction:1" question_ref="ocil:ssg-sebool_boinc_execmem_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cdrecord_read_content_action:testaction:1" question_ref="ocil:ssg-sebool_cdrecord_read_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cluster_can_network_connect_action:testaction:1" question_ref="ocil:ssg-sebool_cluster_can_network_connect_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cluster_manage_all_files_action:testaction:1" question_ref="ocil:ssg-sebool_cluster_manage_all_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cluster_use_execmem_action:testaction:1" question_ref="ocil:ssg-sebool_cluster_use_execmem_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cobbler_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_cobbler_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cobbler_can_network_connect_action:testaction:1" question_ref="ocil:ssg-sebool_cobbler_can_network_connect_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cobbler_use_cifs_action:testaction:1" question_ref="ocil:ssg-sebool_cobbler_use_cifs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cobbler_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_cobbler_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_collectd_tcp_network_connect_action:testaction:1" question_ref="ocil:ssg-sebool_collectd_tcp_network_connect_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_condor_tcp_network_connect_action:testaction:1" question_ref="ocil:ssg-sebool_condor_tcp_network_connect_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_conman_can_network_action:testaction:1" question_ref="ocil:ssg-sebool_conman_can_network_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cron_can_relabel_action:testaction:1" question_ref="ocil:ssg-sebool_cron_can_relabel_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cron_system_cronjob_use_shares_action:testaction:1" question_ref="ocil:ssg-sebool_cron_system_cronjob_use_shares_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cron_userdomain_transition_action:testaction:1" question_ref="ocil:ssg-sebool_cron_userdomain_transition_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cups_execmem_action:testaction:1" question_ref="ocil:ssg-sebool_cups_execmem_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_cvs_read_shadow_action:testaction:1" question_ref="ocil:ssg-sebool_cvs_read_shadow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_daemons_dump_core_action:testaction:1" question_ref="ocil:ssg-sebool_daemons_dump_core_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_daemons_enable_cluster_mode_action:testaction:1" question_ref="ocil:ssg-sebool_daemons_enable_cluster_mode_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_daemons_use_tcp_wrapper_action:testaction:1" question_ref="ocil:ssg-sebool_daemons_use_tcp_wrapper_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_daemons_use_tty_action:testaction:1" question_ref="ocil:ssg-sebool_daemons_use_tty_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_dbadm_exec_content_action:testaction:1" question_ref="ocil:ssg-sebool_dbadm_exec_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_dbadm_manage_user_files_action:testaction:1" question_ref="ocil:ssg-sebool_dbadm_manage_user_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_dbadm_read_user_files_action:testaction:1" question_ref="ocil:ssg-sebool_dbadm_read_user_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_deny_execmem_action:testaction:1" question_ref="ocil:ssg-sebool_deny_execmem_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_deny_ptrace_action:testaction:1" question_ref="ocil:ssg-sebool_deny_ptrace_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_dhcpc_exec_iptables_action:testaction:1" question_ref="ocil:ssg-sebool_dhcpc_exec_iptables_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_dhcpd_use_ldap_action:testaction:1" question_ref="ocil:ssg-sebool_dhcpd_use_ldap_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_docker_connect_any_action:testaction:1" question_ref="ocil:ssg-sebool_docker_connect_any_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_docker_transition_unconfined_action:testaction:1" question_ref="ocil:ssg-sebool_docker_transition_unconfined_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_domain_fd_use_action:testaction:1" question_ref="ocil:ssg-sebool_domain_fd_use_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_domain_kernel_load_modules_action:testaction:1" question_ref="ocil:ssg-sebool_domain_kernel_load_modules_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_entropyd_use_audio_action:testaction:1" question_ref="ocil:ssg-sebool_entropyd_use_audio_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_exim_can_connect_db_action:testaction:1" question_ref="ocil:ssg-sebool_exim_can_connect_db_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_exim_manage_user_files_action:testaction:1" question_ref="ocil:ssg-sebool_exim_manage_user_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_exim_read_user_files_action:testaction:1" question_ref="ocil:ssg-sebool_exim_read_user_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_fcron_crond_action:testaction:1" question_ref="ocil:ssg-sebool_fcron_crond_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_fenced_can_network_connect_action:testaction:1" question_ref="ocil:ssg-sebool_fenced_can_network_connect_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_fenced_can_ssh_action:testaction:1" question_ref="ocil:ssg-sebool_fenced_can_ssh_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_fips_mode_action:testaction:1" question_ref="ocil:ssg-sebool_fips_mode_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ftpd_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_ftpd_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ftpd_connect_all_unreserved_action:testaction:1" question_ref="ocil:ssg-sebool_ftpd_connect_all_unreserved_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ftpd_connect_db_action:testaction:1" question_ref="ocil:ssg-sebool_ftpd_connect_db_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ftpd_full_access_action:testaction:1" question_ref="ocil:ssg-sebool_ftpd_full_access_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ftpd_use_cifs_action:testaction:1" question_ref="ocil:ssg-sebool_ftpd_use_cifs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ftpd_use_fusefs_action:testaction:1" question_ref="ocil:ssg-sebool_ftpd_use_fusefs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ftpd_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_ftpd_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ftpd_use_passive_mode_action:testaction:1" question_ref="ocil:ssg-sebool_ftpd_use_passive_mode_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ftp_home_dir_action:testaction:1" question_ref="ocil:ssg-sebool_ftp_home_dir_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_git_cgi_enable_homedirs_action:testaction:1" question_ref="ocil:ssg-sebool_git_cgi_enable_homedirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_git_cgi_use_cifs_action:testaction:1" question_ref="ocil:ssg-sebool_git_cgi_use_cifs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_git_cgi_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_git_cgi_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_gitosis_can_sendmail_action:testaction:1" question_ref="ocil:ssg-sebool_gitosis_can_sendmail_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_git_session_bind_all_unreserved_ports_action:testaction:1" question_ref="ocil:ssg-sebool_git_session_bind_all_unreserved_ports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_git_session_users_action:testaction:1" question_ref="ocil:ssg-sebool_git_session_users_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_git_system_enable_homedirs_action:testaction:1" question_ref="ocil:ssg-sebool_git_system_enable_homedirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_git_system_use_cifs_action:testaction:1" question_ref="ocil:ssg-sebool_git_system_use_cifs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_git_system_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_git_system_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_glance_api_can_network_action:testaction:1" question_ref="ocil:ssg-sebool_glance_api_can_network_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_glance_use_execmem_action:testaction:1" question_ref="ocil:ssg-sebool_glance_use_execmem_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_glance_use_fusefs_action:testaction:1" question_ref="ocil:ssg-sebool_glance_use_fusefs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_global_ssp_action:testaction:1" question_ref="ocil:ssg-sebool_global_ssp_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_gluster_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_gluster_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_gluster_export_all_ro_action:testaction:1" question_ref="ocil:ssg-sebool_gluster_export_all_ro_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_gluster_export_all_rw_action:testaction:1" question_ref="ocil:ssg-sebool_gluster_export_all_rw_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_gpg_web_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_gpg_web_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_gssd_read_tmp_action:testaction:1" question_ref="ocil:ssg-sebool_gssd_read_tmp_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_guest_exec_content_action:testaction:1" question_ref="ocil:ssg-sebool_guest_exec_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_haproxy_connect_any_action:testaction:1" question_ref="ocil:ssg-sebool_haproxy_connect_any_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_builtin_scripting_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_builtin_scripting_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_check_spam_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_check_spam_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_connect_ftp_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_connect_ftp_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_connect_ldap_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_connect_ldap_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_connect_mythtv_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_connect_mythtv_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_connect_zabbix_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_connect_zabbix_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_network_connect_cobbler_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_network_connect_cobbler_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_network_connect_db_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_network_connect_db_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_network_connect_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_network_connect_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_network_memcache_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_network_memcache_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_network_relay_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_network_relay_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_can_sendmail_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_can_sendmail_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_dbus_avahi_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_dbus_avahi_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_dbus_sssd_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_dbus_sssd_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_dontaudit_search_dirs_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_dontaudit_search_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_enable_cgi_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_enable_cgi_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_enable_ftp_server_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_enable_ftp_server_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_enable_homedirs_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_enable_homedirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_execmem_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_execmem_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_graceful_shutdown_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_graceful_shutdown_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_manage_ipa_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_manage_ipa_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_mod_auth_ntlm_winbind_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_mod_auth_ntlm_winbind_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_mod_auth_pam_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_mod_auth_pam_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_read_user_content_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_read_user_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_run_ipa_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_run_ipa_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_run_preupgrade_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_run_preupgrade_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_run_stickshift_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_run_stickshift_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_serve_cobbler_files_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_serve_cobbler_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_setrlimit_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_setrlimit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_ssi_exec_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_ssi_exec_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_sys_script_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_sys_script_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_tmp_exec_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_tmp_exec_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_tty_comm_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_tty_comm_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_unified_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_unified_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_use_cifs_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_use_cifs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_use_fusefs_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_use_fusefs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_use_gpg_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_use_gpg_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_use_openstack_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_use_openstack_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_use_sasl_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_use_sasl_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_httpd_verify_dns_action:testaction:1" question_ref="ocil:ssg-sebool_httpd_verify_dns_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_icecast_use_any_tcp_ports_action:testaction:1" question_ref="ocil:ssg-sebool_icecast_use_any_tcp_ports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_irc_use_any_tcp_ports_action:testaction:1" question_ref="ocil:ssg-sebool_irc_use_any_tcp_ports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_irssi_use_full_network_action:testaction:1" question_ref="ocil:ssg-sebool_irssi_use_full_network_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_kdumpgui_run_bootloader_action:testaction:1" question_ref="ocil:ssg-sebool_kdumpgui_run_bootloader_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_kerberos_enabled_action:testaction:1" question_ref="ocil:ssg-sebool_kerberos_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ksmtuned_use_cifs_action:testaction:1" question_ref="ocil:ssg-sebool_ksmtuned_use_cifs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ksmtuned_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_ksmtuned_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_logadm_exec_content_action:testaction:1" question_ref="ocil:ssg-sebool_logadm_exec_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_logging_syslogd_can_sendmail_action:testaction:1" question_ref="ocil:ssg-sebool_logging_syslogd_can_sendmail_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_logging_syslogd_run_nagios_plugins_action:testaction:1" question_ref="ocil:ssg-sebool_logging_syslogd_run_nagios_plugins_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_logging_syslogd_use_tty_action:testaction:1" question_ref="ocil:ssg-sebool_logging_syslogd_use_tty_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_login_console_enabled_action:testaction:1" question_ref="ocil:ssg-sebool_login_console_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_logrotate_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_logrotate_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_logwatch_can_network_connect_mail_action:testaction:1" question_ref="ocil:ssg-sebool_logwatch_can_network_connect_mail_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_lsmd_plugin_connect_any_action:testaction:1" question_ref="ocil:ssg-sebool_lsmd_plugin_connect_any_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mailman_use_fusefs_action:testaction:1" question_ref="ocil:ssg-sebool_mailman_use_fusefs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mcelog_client_action:testaction:1" question_ref="ocil:ssg-sebool_mcelog_client_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mcelog_exec_scripts_action:testaction:1" question_ref="ocil:ssg-sebool_mcelog_exec_scripts_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mcelog_foreground_action:testaction:1" question_ref="ocil:ssg-sebool_mcelog_foreground_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mcelog_server_action:testaction:1" question_ref="ocil:ssg-sebool_mcelog_server_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_minidlna_read_generic_user_content_action:testaction:1" question_ref="ocil:ssg-sebool_minidlna_read_generic_user_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mmap_low_allowed_action:testaction:1" question_ref="ocil:ssg-sebool_mmap_low_allowed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mock_enable_homedirs_action:testaction:1" question_ref="ocil:ssg-sebool_mock_enable_homedirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mount_anyfile_action:testaction:1" question_ref="ocil:ssg-sebool_mount_anyfile_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mozilla_plugin_bind_unreserved_ports_action:testaction:1" question_ref="ocil:ssg-sebool_mozilla_plugin_bind_unreserved_ports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mozilla_plugin_can_network_connect_action:testaction:1" question_ref="ocil:ssg-sebool_mozilla_plugin_can_network_connect_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mozilla_plugin_use_bluejeans_action:testaction:1" question_ref="ocil:ssg-sebool_mozilla_plugin_use_bluejeans_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mozilla_plugin_use_gps_action:testaction:1" question_ref="ocil:ssg-sebool_mozilla_plugin_use_gps_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mozilla_plugin_use_spice_action:testaction:1" question_ref="ocil:ssg-sebool_mozilla_plugin_use_spice_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mozilla_read_content_action:testaction:1" question_ref="ocil:ssg-sebool_mozilla_read_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mpd_enable_homedirs_action:testaction:1" question_ref="ocil:ssg-sebool_mpd_enable_homedirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mpd_use_cifs_action:testaction:1" question_ref="ocil:ssg-sebool_mpd_use_cifs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mpd_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_mpd_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mplayer_execstack_action:testaction:1" question_ref="ocil:ssg-sebool_mplayer_execstack_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_mysql_connect_any_action:testaction:1" question_ref="ocil:ssg-sebool_mysql_connect_any_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_nagios_run_pnp4nagios_action:testaction:1" question_ref="ocil:ssg-sebool_nagios_run_pnp4nagios_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_nagios_run_sudo_action:testaction:1" question_ref="ocil:ssg-sebool_nagios_run_sudo_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_named_tcp_bind_http_port_action:testaction:1" question_ref="ocil:ssg-sebool_named_tcp_bind_http_port_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_named_write_master_zones_action:testaction:1" question_ref="ocil:ssg-sebool_named_write_master_zones_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_neutron_can_network_action:testaction:1" question_ref="ocil:ssg-sebool_neutron_can_network_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_nfsd_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_nfsd_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_nfs_export_all_ro_action:testaction:1" question_ref="ocil:ssg-sebool_nfs_export_all_ro_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_nfs_export_all_rw_action:testaction:1" question_ref="ocil:ssg-sebool_nfs_export_all_rw_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_nis_enabled_action:testaction:1" question_ref="ocil:ssg-sebool_nis_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_nscd_use_shm_action:testaction:1" question_ref="ocil:ssg-sebool_nscd_use_shm_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_openshift_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_openshift_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_openvpn_can_network_connect_action:testaction:1" question_ref="ocil:ssg-sebool_openvpn_can_network_connect_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_openvpn_enable_homedirs_action:testaction:1" question_ref="ocil:ssg-sebool_openvpn_enable_homedirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_openvpn_run_unconfined_action:testaction:1" question_ref="ocil:ssg-sebool_openvpn_run_unconfined_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_pcp_bind_all_unreserved_ports_action:testaction:1" question_ref="ocil:ssg-sebool_pcp_bind_all_unreserved_ports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_pcp_read_generic_logs_action:testaction:1" question_ref="ocil:ssg-sebool_pcp_read_generic_logs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_piranha_lvs_can_network_connect_action:testaction:1" question_ref="ocil:ssg-sebool_piranha_lvs_can_network_connect_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_polipo_connect_all_unreserved_action:testaction:1" question_ref="ocil:ssg-sebool_polipo_connect_all_unreserved_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_polipo_session_bind_all_unreserved_ports_action:testaction:1" question_ref="ocil:ssg-sebool_polipo_session_bind_all_unreserved_ports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_polipo_session_users_action:testaction:1" question_ref="ocil:ssg-sebool_polipo_session_users_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_polipo_use_cifs_action:testaction:1" question_ref="ocil:ssg-sebool_polipo_use_cifs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_polipo_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_polipo_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_polyinstantiation_enabled_action:testaction:1" question_ref="ocil:ssg-sebool_polyinstantiation_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_postfix_local_write_mail_spool_action:testaction:1" question_ref="ocil:ssg-sebool_postfix_local_write_mail_spool_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_postgresql_can_rsync_action:testaction:1" question_ref="ocil:ssg-sebool_postgresql_can_rsync_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_postgresql_selinux_transmit_client_label_action:testaction:1" question_ref="ocil:ssg-sebool_postgresql_selinux_transmit_client_label_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_postgresql_selinux_unconfined_dbadm_action:testaction:1" question_ref="ocil:ssg-sebool_postgresql_selinux_unconfined_dbadm_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_postgresql_selinux_users_ddl_action:testaction:1" question_ref="ocil:ssg-sebool_postgresql_selinux_users_ddl_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_pppd_can_insmod_action:testaction:1" question_ref="ocil:ssg-sebool_pppd_can_insmod_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_pppd_for_user_action:testaction:1" question_ref="ocil:ssg-sebool_pppd_for_user_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_privoxy_connect_any_action:testaction:1" question_ref="ocil:ssg-sebool_privoxy_connect_any_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_prosody_bind_http_port_action:testaction:1" question_ref="ocil:ssg-sebool_prosody_bind_http_port_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_puppetagent_manage_all_files_action:testaction:1" question_ref="ocil:ssg-sebool_puppetagent_manage_all_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_puppetmaster_use_db_action:testaction:1" question_ref="ocil:ssg-sebool_puppetmaster_use_db_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_racoon_read_shadow_action:testaction:1" question_ref="ocil:ssg-sebool_racoon_read_shadow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_rsync_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_rsync_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_rsync_client_action:testaction:1" question_ref="ocil:ssg-sebool_rsync_client_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_rsync_export_all_ro_action:testaction:1" question_ref="ocil:ssg-sebool_rsync_export_all_ro_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_rsync_full_access_action:testaction:1" question_ref="ocil:ssg-sebool_rsync_full_access_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_samba_create_home_dirs_action:testaction:1" question_ref="ocil:ssg-sebool_samba_create_home_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_samba_domain_controller_action:testaction:1" question_ref="ocil:ssg-sebool_samba_domain_controller_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_samba_enable_home_dirs_action:testaction:1" question_ref="ocil:ssg-sebool_samba_enable_home_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_samba_export_all_ro_action:testaction:1" question_ref="ocil:ssg-sebool_samba_export_all_ro_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_samba_export_all_rw_action:testaction:1" question_ref="ocil:ssg-sebool_samba_export_all_rw_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_samba_load_libgfapi_action:testaction:1" question_ref="ocil:ssg-sebool_samba_load_libgfapi_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_samba_portmapper_action:testaction:1" question_ref="ocil:ssg-sebool_samba_portmapper_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_samba_run_unconfined_action:testaction:1" question_ref="ocil:ssg-sebool_samba_run_unconfined_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_samba_share_fusefs_action:testaction:1" question_ref="ocil:ssg-sebool_samba_share_fusefs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_samba_share_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_samba_share_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_sanlock_use_fusefs_action:testaction:1" question_ref="ocil:ssg-sebool_sanlock_use_fusefs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_sanlock_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_sanlock_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_sanlock_use_samba_action:testaction:1" question_ref="ocil:ssg-sebool_sanlock_use_samba_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_saslauthd_read_shadow_action:testaction:1" question_ref="ocil:ssg-sebool_saslauthd_read_shadow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_secadm_exec_content_action:testaction:1" question_ref="ocil:ssg-sebool_secadm_exec_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_secure_mode_insmod_action:testaction:1" question_ref="ocil:ssg-sebool_secure_mode_insmod_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_secure_mode_action:testaction:1" question_ref="ocil:ssg-sebool_secure_mode_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_secure_mode_policyload_action:testaction:1" question_ref="ocil:ssg-sebool_secure_mode_policyload_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_direct_dri_enabled_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_direct_dri_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_execheap_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_execheap_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_execmod_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_execmod_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_execstack_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_execstack_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_mysql_connect_enabled_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_mysql_connect_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_ping_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_ping_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_postgresql_connect_enabled_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_postgresql_connect_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_rw_noexattrfile_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_rw_noexattrfile_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_share_music_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_share_music_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_tcp_server_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_tcp_server_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_udp_server_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_udp_server_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_selinuxuser_use_ssh_chroot_action:testaction:1" question_ref="ocil:ssg-sebool_selinuxuser_use_ssh_chroot_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_sftpd_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_sftpd_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_sftpd_enable_homedirs_action:testaction:1" question_ref="ocil:ssg-sebool_sftpd_enable_homedirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_sftpd_full_access_action:testaction:1" question_ref="ocil:ssg-sebool_sftpd_full_access_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_sftpd_write_ssh_home_action:testaction:1" question_ref="ocil:ssg-sebool_sftpd_write_ssh_home_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_sge_domain_can_network_connect_action:testaction:1" question_ref="ocil:ssg-sebool_sge_domain_can_network_connect_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_sge_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_sge_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_smartmon_3ware_action:testaction:1" question_ref="ocil:ssg-sebool_smartmon_3ware_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_smbd_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_smbd_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_spamassassin_can_network_action:testaction:1" question_ref="ocil:ssg-sebool_spamassassin_can_network_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_spamd_enable_home_dirs_action:testaction:1" question_ref="ocil:ssg-sebool_spamd_enable_home_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_squid_connect_any_action:testaction:1" question_ref="ocil:ssg-sebool_squid_connect_any_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_squid_use_tproxy_action:testaction:1" question_ref="ocil:ssg-sebool_squid_use_tproxy_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ssh_chroot_rw_homedirs_action:testaction:1" question_ref="ocil:ssg-sebool_ssh_chroot_rw_homedirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ssh_keysign_action:testaction:1" question_ref="ocil:ssg-sebool_ssh_keysign_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_ssh_sysadm_login_action:testaction:1" question_ref="ocil:ssg-sebool_ssh_sysadm_login_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_staff_exec_content_action:testaction:1" question_ref="ocil:ssg-sebool_staff_exec_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_staff_use_svirt_action:testaction:1" question_ref="ocil:ssg-sebool_staff_use_svirt_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_swift_can_network_action:testaction:1" question_ref="ocil:ssg-sebool_swift_can_network_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_sysadm_exec_content_action:testaction:1" question_ref="ocil:ssg-sebool_sysadm_exec_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_telepathy_connect_all_ports_action:testaction:1" question_ref="ocil:ssg-sebool_telepathy_connect_all_ports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_telepathy_tcp_connect_generic_network_ports_action:testaction:1" question_ref="ocil:ssg-sebool_telepathy_tcp_connect_generic_network_ports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_tftp_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_tftp_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_tftp_home_dir_action:testaction:1" question_ref="ocil:ssg-sebool_tftp_home_dir_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_tmpreaper_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_tmpreaper_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_tmpreaper_use_samba_action:testaction:1" question_ref="ocil:ssg-sebool_tmpreaper_use_samba_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_tor_bind_all_unreserved_ports_action:testaction:1" question_ref="ocil:ssg-sebool_tor_bind_all_unreserved_ports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_tor_can_network_relay_action:testaction:1" question_ref="ocil:ssg-sebool_tor_can_network_relay_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_unconfined_chrome_sandbox_transition_action:testaction:1" question_ref="ocil:ssg-sebool_unconfined_chrome_sandbox_transition_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_unconfined_login_action:testaction:1" question_ref="ocil:ssg-sebool_unconfined_login_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_unconfined_mozilla_plugin_transition_action:testaction:1" question_ref="ocil:ssg-sebool_unconfined_mozilla_plugin_transition_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_unprivuser_use_svirt_action:testaction:1" question_ref="ocil:ssg-sebool_unprivuser_use_svirt_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_use_ecryptfs_home_dirs_action:testaction:1" question_ref="ocil:ssg-sebool_use_ecryptfs_home_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_use_fusefs_home_dirs_action:testaction:1" question_ref="ocil:ssg-sebool_use_fusefs_home_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_use_lpd_server_action:testaction:1" question_ref="ocil:ssg-sebool_use_lpd_server_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_use_nfs_home_dirs_action:testaction:1" question_ref="ocil:ssg-sebool_use_nfs_home_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_user_exec_content_action:testaction:1" question_ref="ocil:ssg-sebool_user_exec_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_use_samba_home_dirs_action:testaction:1" question_ref="ocil:ssg-sebool_use_samba_home_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_varnishd_connect_any_action:testaction:1" question_ref="ocil:ssg-sebool_varnishd_connect_any_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_read_qemu_ga_data_action:testaction:1" question_ref="ocil:ssg-sebool_virt_read_qemu_ga_data_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_rw_qemu_ga_data_action:testaction:1" question_ref="ocil:ssg-sebool_virt_rw_qemu_ga_data_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_sandbox_use_all_caps_action:testaction:1" question_ref="ocil:ssg-sebool_virt_sandbox_use_all_caps_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_sandbox_use_audit_action:testaction:1" question_ref="ocil:ssg-sebool_virt_sandbox_use_audit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_sandbox_use_mknod_action:testaction:1" question_ref="ocil:ssg-sebool_virt_sandbox_use_mknod_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_sandbox_use_netlink_action:testaction:1" question_ref="ocil:ssg-sebool_virt_sandbox_use_netlink_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_sandbox_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_virt_sandbox_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_sandbox_use_samba_action:testaction:1" question_ref="ocil:ssg-sebool_virt_sandbox_use_samba_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_sandbox_use_sys_admin_action:testaction:1" question_ref="ocil:ssg-sebool_virt_sandbox_use_sys_admin_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_transition_userdomain_action:testaction:1" question_ref="ocil:ssg-sebool_virt_transition_userdomain_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_use_comm_action:testaction:1" question_ref="ocil:ssg-sebool_virt_use_comm_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_use_execmem_action:testaction:1" question_ref="ocil:ssg-sebool_virt_use_execmem_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_use_fusefs_action:testaction:1" question_ref="ocil:ssg-sebool_virt_use_fusefs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_virt_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_use_rawip_action:testaction:1" question_ref="ocil:ssg-sebool_virt_use_rawip_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_use_samba_action:testaction:1" question_ref="ocil:ssg-sebool_virt_use_samba_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_use_sanlock_action:testaction:1" question_ref="ocil:ssg-sebool_virt_use_sanlock_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_use_usb_action:testaction:1" question_ref="ocil:ssg-sebool_virt_use_usb_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_virt_use_xserver_action:testaction:1" question_ref="ocil:ssg-sebool_virt_use_xserver_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_webadm_manage_user_files_action:testaction:1" question_ref="ocil:ssg-sebool_webadm_manage_user_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_webadm_read_user_files_action:testaction:1" question_ref="ocil:ssg-sebool_webadm_read_user_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_wine_mmap_zero_ignore_action:testaction:1" question_ref="ocil:ssg-sebool_wine_mmap_zero_ignore_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xdm_bind_vnc_tcp_port_action:testaction:1" question_ref="ocil:ssg-sebool_xdm_bind_vnc_tcp_port_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xdm_exec_bootloader_action:testaction:1" question_ref="ocil:ssg-sebool_xdm_exec_bootloader_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xdm_sysadm_login_action:testaction:1" question_ref="ocil:ssg-sebool_xdm_sysadm_login_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xdm_write_home_action:testaction:1" question_ref="ocil:ssg-sebool_xdm_write_home_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xend_run_blktap_action:testaction:1" question_ref="ocil:ssg-sebool_xend_run_blktap_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xend_run_qemu_action:testaction:1" question_ref="ocil:ssg-sebool_xend_run_qemu_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xen_use_nfs_action:testaction:1" question_ref="ocil:ssg-sebool_xen_use_nfs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xguest_connect_network_action:testaction:1" question_ref="ocil:ssg-sebool_xguest_connect_network_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xguest_exec_content_action:testaction:1" question_ref="ocil:ssg-sebool_xguest_exec_content_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xguest_mount_media_action:testaction:1" question_ref="ocil:ssg-sebool_xguest_mount_media_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xguest_use_bluetooth_action:testaction:1" question_ref="ocil:ssg-sebool_xguest_use_bluetooth_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xserver_clients_write_xshm_action:testaction:1" question_ref="ocil:ssg-sebool_xserver_clients_write_xshm_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xserver_execmem_action:testaction:1" question_ref="ocil:ssg-sebool_xserver_execmem_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_xserver_object_manager_action:testaction:1" question_ref="ocil:ssg-sebool_xserver_object_manager_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_zabbix_can_network_action:testaction:1" question_ref="ocil:ssg-sebool_zabbix_can_network_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_zarafa_setrlimit_action:testaction:1" question_ref="ocil:ssg-sebool_zarafa_setrlimit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_zebra_write_config_action:testaction:1" question_ref="ocil:ssg-sebool_zebra_write_config_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_zoneminder_anon_write_action:testaction:1" question_ref="ocil:ssg-sebool_zoneminder_anon_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sebool_zoneminder_run_sudo_action:testaction:1" question_ref="ocil:ssg-sebool_zoneminder_run_sudo_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-no_direct_root_logins_action:testaction:1" question_ref="ocil:ssg-no_direct_root_logins_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-securetty_root_login_console_only_action:testaction:1" question_ref="ocil:ssg-securetty_root_login_console_only_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-restrict_serial_port_logins_action:testaction:1" question_ref="ocil:ssg-restrict_serial_port_logins_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-no_root_webbrowsing_action:testaction:1" question_ref="ocil:ssg-no_root_webbrowsing_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-no_shelllogin_for_systemaccounts_action:testaction:1" question_ref="ocil:ssg-no_shelllogin_for_systemaccounts_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_no_uid_except_zero_action:testaction:1" question_ref="ocil:ssg-accounts_no_uid_except_zero_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-root_path_default_action:testaction:1" question_ref="ocil:ssg-root_path_default_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-no_empty_passwords_action:testaction:1" question_ref="ocil:ssg-no_empty_passwords_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_all_shadowed_action:testaction:1" question_ref="ocil:ssg-accounts_password_all_shadowed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-gid_passwd_group_same_action:testaction:1" question_ref="ocil:ssg-gid_passwd_group_same_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-no_netrc_files_action:testaction:1" question_ref="ocil:ssg-no_netrc_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_minlen_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_password_minlen_login_defs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_minimum_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_minimum_age_login_defs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_maximum_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_maximum_age_login_defs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_warn_age_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_password_warn_age_login_defs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-account_disable_post_pw_expiration_action:testaction:1" question_ref="ocil:ssg-account_disable_post_pw_expiration_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-account_unique_name_action:testaction:1" question_ref="ocil:ssg-account_unique_name_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-account_temp_expire_date_action:testaction:1" question_ref="ocil:ssg-account_temp_expire_date_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-display_login_attempts_action:testaction:1" question_ref="ocil:ssg-display_login_attempts_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_retry_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_retry_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_maxrepeat_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_maxrepeat_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_maxclassrepeat_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_maxclassrepeat_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_dcredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_dcredit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_minlen_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_minlen_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_ucredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_ucredit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_ocredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_ocredit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_lcredit_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_lcredit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_difok_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_difok_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_minclass_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_minclass_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_deny_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_deny_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_deny_root_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_passwords_pam_faillock_interval_action:testaction:1" question_ref="ocil:ssg-accounts_passwords_pam_faillock_interval_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_password_pam_unix_remember_action:testaction:1" question_ref="ocil:ssg-accounts_password_pam_unix_remember_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_systemauth_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_logindefs_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_logindefs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-set_password_hashing_algorithm_libuserconf_action:testaction:1" question_ref="ocil:ssg-set_password_hashing_algorithm_libuserconf_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_tmout_action:testaction:1" question_ref="ocil:ssg-accounts_tmout_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_max_concurrent_login_sessions_action:testaction:1" question_ref="ocil:ssg-accounts_max_concurrent_login_sessions_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_logon_fail_delay_action:testaction:1" question_ref="ocil:ssg-accounts_logon_fail_delay_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_root_path_dirs_no_write_action:testaction:1" question_ref="ocil:ssg-accounts_root_path_dirs_no_write_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_home_dirs_action:testaction:1" question_ref="ocil:ssg-file_permissions_home_dirs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_umask_etc_bashrc_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_bashrc_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_umask_etc_csh_cshrc_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_csh_cshrc_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_umask_etc_profile_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_profile_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-accounts_umask_etc_login_defs_action:testaction:1" question_ref="ocil:ssg-accounts_umask_etc_login_defs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_user_owner_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_user_owner_grub2_cfg_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_group_owner_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_group_owner_grub2_cfg_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_grub2_cfg_action:testaction:1" question_ref="ocil:ssg-file_permissions_grub2_cfg_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-bootloader_password_action:testaction:1" question_ref="ocil:ssg-bootloader_password_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-bootloader_uefi_password_action:testaction:1" question_ref="ocil:ssg-bootloader_uefi_password_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-require_singleuser_auth_action:testaction:1" question_ref="ocil:ssg-require_singleuser_auth_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_debug-shell_disabled_action:testaction:1" question_ref="ocil:ssg-service_debug-shell_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-disable_ctrlaltdel_reboot_action:testaction:1" question_ref="ocil:ssg-disable_ctrlaltdel_reboot_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-disable_interactive_boot_action:testaction:1" question_ref="ocil:ssg-disable_interactive_boot_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_screen_installed_action:testaction:1" question_ref="ocil:ssg-package_screen_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-smartcard_auth_action:testaction:1" question_ref="ocil:ssg-smartcard_auth_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-banner_etc_issue_action:testaction:1" question_ref="ocil:ssg-banner_etc_issue_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_banner_enabled_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_banner_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-dconf_gnome_login_banner_text_action:testaction:1" question_ref="ocil:ssg-dconf_gnome_login_banner_text_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-network_disable_ddns_interfaces_action:testaction:1" question_ref="ocil:ssg-network_disable_ddns_interfaces_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-network_sniffer_disabled_action:testaction:1" question_ref="ocil:ssg-network_sniffer_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_ip_forward_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_ip_forward_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_bluetooth_disabled_action:testaction:1" question_ref="ocil:ssg-service_bluetooth_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-kernel_module_bluetooth_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_bluetooth_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_kernel_ipv6_disable_action:testaction:1" question_ref="ocil:ssg-sysctl_kernel_ipv6_disable_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_action:testaction:1" question_ref="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_firewalld_enabled_action:testaction:1" question_ref="ocil:ssg-service_firewalld_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-set_firewalld_default_zone_action:testaction:1" question_ref="ocil:ssg-set_firewalld_default_zone_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-kernel_module_dccp_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_dccp_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-kernel_module_sctp_disabled_action:testaction:1" question_ref="ocil:ssg-kernel_module_sctp_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_libreswan_installed_action:testaction:1" question_ref="ocil:ssg-package_libreswan_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-libreswan_approved_tunnels_action:testaction:1" question_ref="ocil:ssg-libreswan_approved_tunnels_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_rsyslog_installed_action:testaction:1" question_ref="ocil:ssg-package_rsyslog_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_rsyslog_enabled_action:testaction:1" question_ref="ocil:ssg-service_rsyslog_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rsyslog_files_ownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_ownership_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rsyslog_files_groupownership_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_groupownership_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rsyslog_files_permissions_action:testaction:1" question_ref="ocil:ssg-rsyslog_files_permissions_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rsyslog_cron_logging_action:testaction:1" question_ref="ocil:ssg-rsyslog_cron_logging_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-rsyslog_remote_loghost_action:testaction:1" question_ref="ocil:ssg-rsyslog_remote_loghost_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ensure_logrotate_activated_action:testaction:1" question_ref="ocil:ssg-ensure_logrotate_activated_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_auditd_enabled_action:testaction:1" question_ref="ocil:ssg-service_auditd_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-bootloader_audit_argument_action:testaction:1" question_ref="ocil:ssg-bootloader_audit_argument_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-auditd_data_retention_num_logs_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_num_logs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-auditd_data_retention_max_log_file_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_max_log_file_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-auditd_data_retention_max_log_file_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_max_log_file_action_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-auditd_data_retention_space_left_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_space_left_action_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-auditd_data_retention_admin_space_left_action_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_admin_space_left_action_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-auditd_data_retention_action_mail_acct_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_action_mail_acct_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-auditd_data_retention_flush_action:testaction:1" question_ref="ocil:ssg-auditd_data_retention_flush_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-auditd_audispd_syslog_plugin_activated_action:testaction:1" question_ref="ocil:ssg-auditd_audispd_syslog_plugin_activated_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_time_adjtimex_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_adjtimex_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_time_settimeofday_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_settimeofday_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_time_stime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_stime_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_time_clock_settime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_clock_settime_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_time_watch_localtime_action:testaction:1" question_ref="ocil:ssg-audit_rules_time_watch_localtime_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_usergroup_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_usergroup_modification_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_networkconfig_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_networkconfig_modification_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_permissions_var_log_audit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_ownership_var_log_audit_action:testaction:1" question_ref="ocil:ssg-file_ownership_var_log_audit_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_mac_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_mac_modification_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_chmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_chmod_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_chown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_chown_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchmod_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchmod_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchmodat_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchmodat_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchown_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fchownat_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fchownat_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fremovexattr_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_fsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_fsetxattr_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lchown_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lchown_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lremovexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lremovexattr_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_lsetxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_lsetxattr_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_removexattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_removexattr_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_dac_modification_setxattr_action:testaction:1" question_ref="ocil:ssg-audit_rules_dac_modification_setxattr_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1" question_ref="ocil:ssg-audit_rules_unsuccessful_file_modification_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_privileged_commands_action:testaction:1" question_ref="ocil:ssg-audit_rules_privileged_commands_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_media_export_action:testaction:1" question_ref="ocil:ssg-audit_rules_media_export_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_file_deletion_events_action:testaction:1" question_ref="ocil:ssg-audit_rules_file_deletion_events_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_sysadmin_actions_action:testaction:1" question_ref="ocil:ssg-audit_rules_sysadmin_actions_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-audit_rules_kernel_module_loading_action:testaction:1" question_ref="ocil:ssg-audit_rules_kernel_module_loading_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_xinetd_disabled_action:testaction:1" question_ref="ocil:ssg-service_xinetd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_xinetd_removed_action:testaction:1" question_ref="ocil:ssg-package_xinetd_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_tcp_wrappers_installed_action:testaction:1" question_ref="ocil:ssg-package_tcp_wrappers_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_telnet_disabled_action:testaction:1" question_ref="ocil:ssg-service_telnet_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_telnet-server_removed_action:testaction:1" question_ref="ocil:ssg-package_telnet-server_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_telnet_removed_action:testaction:1" question_ref="ocil:ssg-package_telnet_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_rsh-server_removed_action:testaction:1" question_ref="ocil:ssg-package_rsh-server_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_rexec_disabled_action:testaction:1" question_ref="ocil:ssg-service_rexec_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_rsh_disabled_action:testaction:1" question_ref="ocil:ssg-service_rsh_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_rsh_removed_action:testaction:1" question_ref="ocil:ssg-package_rsh_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_rlogin_disabled_action:testaction:1" question_ref="ocil:ssg-service_rlogin_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-no_rsh_trust_files_action:testaction:1" question_ref="ocil:ssg-no_rsh_trust_files_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_ypserv_removed_action:testaction:1" question_ref="ocil:ssg-package_ypserv_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_ypbind_disabled_action:testaction:1" question_ref="ocil:ssg-service_ypbind_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_ypbind_removed_action:testaction:1" question_ref="ocil:ssg-package_ypbind_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_tftp_disabled_action:testaction:1" question_ref="ocil:ssg-service_tftp_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_tftp-server_removed_action:testaction:1" question_ref="ocil:ssg-package_tftp-server_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_tftp_removed_action:testaction:1" question_ref="ocil:ssg-package_tftp_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-tftpd_uses_secure_mode_action:testaction:1" question_ref="ocil:ssg-tftpd_uses_secure_mode_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_talk-server_removed_action:testaction:1" question_ref="ocil:ssg-package_talk-server_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_talk_removed_action:testaction:1" question_ref="ocil:ssg-package_talk_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_abrtd_disabled_action:testaction:1" question_ref="ocil:ssg-service_abrtd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_acpid_disabled_action:testaction:1" question_ref="ocil:ssg-service_acpid_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_certmonger_disabled_action:testaction:1" question_ref="ocil:ssg-service_certmonger_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_cgconfig_disabled_action:testaction:1" question_ref="ocil:ssg-service_cgconfig_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_cgred_disabled_action:testaction:1" question_ref="ocil:ssg-service_cgred_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_cpupower_disabled_action:testaction:1" question_ref="ocil:ssg-service_cpupower_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_irqbalance_enabled_action:testaction:1" question_ref="ocil:ssg-service_irqbalance_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_kdump_disabled_action:testaction:1" question_ref="ocil:ssg-service_kdump_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_mdmonitor_disabled_action:testaction:1" question_ref="ocil:ssg-service_mdmonitor_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_messagebus_disabled_action:testaction:1" question_ref="ocil:ssg-service_messagebus_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_netconsole_disabled_action:testaction:1" question_ref="ocil:ssg-service_netconsole_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_ntpdate_disabled_action:testaction:1" question_ref="ocil:ssg-service_ntpdate_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_oddjobd_disabled_action:testaction:1" question_ref="ocil:ssg-service_oddjobd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_portreserve_disabled_action:testaction:1" question_ref="ocil:ssg-service_portreserve_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_psacct_enabled_action:testaction:1" question_ref="ocil:ssg-service_psacct_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_qpidd_disabled_action:testaction:1" question_ref="ocil:ssg-service_qpidd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_quota_nld_disabled_action:testaction:1" question_ref="ocil:ssg-service_quota_nld_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_rdisc_disabled_action:testaction:1" question_ref="ocil:ssg-service_rdisc_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_rhnsd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rhnsd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_rhsmcertd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rhsmcertd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_saslauthd_disabled_action:testaction:1" question_ref="ocil:ssg-service_saslauthd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_smartd_disabled_action:testaction:1" question_ref="ocil:ssg-service_smartd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_sysstat_disabled_action:testaction:1" question_ref="ocil:ssg-service_sysstat_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_crond_enabled_action:testaction:1" question_ref="ocil:ssg-service_crond_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-disable_anacron_action:testaction:1" question_ref="ocil:ssg-disable_anacron_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_atd_disabled_action:testaction:1" question_ref="ocil:ssg-service_atd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_owner_cron_allow_action:testaction:1" question_ref="ocil:ssg-file_owner_cron_allow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_groupowner_cron_allow_action:testaction:1" question_ref="ocil:ssg-file_groupowner_cron_allow_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_docker_enabled_action:testaction:1" question_ref="ocil:ssg-service_docker_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_openssh-server_installed_action:testaction:1" question_ref="ocil:ssg-package_openssh-server_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_sshd_enabled_action:testaction:1" question_ref="ocil:ssg-service_sshd_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_pub_key_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-file_permissions_sshd_private_key_action:testaction:1" question_ref="ocil:ssg-file_permissions_sshd_private_key_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-firewalld_sshd_port_enabled_action:testaction:1" question_ref="ocil:ssg-firewalld_sshd_port_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_allow_only_protocol2_action:testaction:1" question_ref="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_disable_gssapi_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_gssapi_auth_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_disable_kerb_auth_action:testaction:1" question_ref="ocil:ssg-sshd_disable_kerb_auth_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_enable_strictmodes_action:testaction:1" question_ref="ocil:ssg-sshd_enable_strictmodes_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_use_priv_separation_action:testaction:1" question_ref="ocil:ssg-sshd_use_priv_separation_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_disable_compression_action:testaction:1" question_ref="ocil:ssg-sshd_disable_compression_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_print_last_log_action:testaction:1" question_ref="ocil:ssg-sshd_print_last_log_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_set_idle_timeout_action:testaction:1" question_ref="ocil:ssg-sshd_set_idle_timeout_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_set_keepalive_action:testaction:1" question_ref="ocil:ssg-sshd_set_keepalive_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_disable_rhosts_action:testaction:1" question_ref="ocil:ssg-sshd_disable_rhosts_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_disable_user_known_hosts_action:testaction:1" question_ref="ocil:ssg-sshd_disable_user_known_hosts_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_disable_rhosts_rsa_action:testaction:1" question_ref="ocil:ssg-sshd_disable_rhosts_rsa_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-disable_host_auth_action:testaction:1" question_ref="ocil:ssg-disable_host_auth_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-enable_x11_forwarding_action:testaction:1" question_ref="ocil:ssg-enable_x11_forwarding_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_disable_root_login_action:testaction:1" question_ref="ocil:ssg-sshd_disable_root_login_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_disable_empty_passwords_action:testaction:1" question_ref="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_enable_warning_banner_action:testaction:1" question_ref="ocil:ssg-sshd_enable_warning_banner_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_do_not_permit_user_env_action:testaction:1" question_ref="ocil:ssg-sshd_do_not_permit_user_env_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_use_approved_ciphers_action:testaction:1" question_ref="ocil:ssg-sshd_use_approved_ciphers_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sshd_use_approved_macs_action:testaction:1" question_ref="ocil:ssg-sshd_use_approved_macs_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_sssd_installed_action:testaction:1" question_ref="ocil:ssg-package_sssd_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_sssd_enabled_action:testaction:1" question_ref="ocil:ssg-service_sssd_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sssd_memcache_timeout_action:testaction:1" question_ref="ocil:ssg-sssd_memcache_timeout_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sssd_offline_cred_expiration_action:testaction:1" question_ref="ocil:ssg-sssd_offline_cred_expiration_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sssd_ssh_known_hosts_timeout_action:testaction:1" question_ref="ocil:ssg-sssd_ssh_known_hosts_timeout_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-xwindows_runlevel_setting_action:testaction:1" question_ref="ocil:ssg-xwindows_runlevel_setting_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_xorg-x11-server-common_removed_action:testaction:1" question_ref="ocil:ssg-package_xorg-x11-server-common_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_avahi-daemon_disabled_action:testaction:1" question_ref="ocil:ssg-service_avahi-daemon_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_cups_disabled_action:testaction:1" question_ref="ocil:ssg-service_cups_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_dhcpd_disabled_action:testaction:1" question_ref="ocil:ssg-service_dhcpd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_dhcp_removed_action:testaction:1" question_ref="ocil:ssg-package_dhcp_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-sysconfig_networking_bootproto_ifcfg_action:testaction:1" question_ref="ocil:ssg-sysconfig_networking_bootproto_ifcfg_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_chronyd_or_ntpd_enabled_action:testaction:1" question_ref="ocil:ssg-service_chronyd_or_ntpd_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-chronyd_or_ntpd_specify_remote_server_action:testaction:1" question_ref="ocil:ssg-chronyd_or_ntpd_specify_remote_server_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_postfix_enabled_action:testaction:1" question_ref="ocil:ssg-service_postfix_enabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_sendmail_removed_action:testaction:1" question_ref="ocil:ssg-package_sendmail_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-postfix_network_listening_disabled_action:testaction:1" question_ref="ocil:ssg-postfix_network_listening_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ldap_client_start_tls_action:testaction:1" question_ref="ocil:ssg-ldap_client_start_tls_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ldap_client_tls_cacertpath_action:testaction:1" question_ref="ocil:ssg-ldap_client_tls_cacertpath_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_openldap-servers_removed_action:testaction:1" question_ref="ocil:ssg-package_openldap-servers_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-nfs_no_anonymous_action:testaction:1" question_ref="ocil:ssg-nfs_no_anonymous_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_nfs_disabled_action:testaction:1" question_ref="ocil:ssg-service_nfs_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_rpcsvcgssd_disabled_action:testaction:1" question_ref="ocil:ssg-service_rpcsvcgssd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-mount_option_nodev_remote_filesystems_action:testaction:1" question_ref="ocil:ssg-mount_option_nodev_remote_filesystems_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-mount_option_nosuid_remote_filesystems_action:testaction:1" question_ref="ocil:ssg-mount_option_nosuid_remote_filesystems_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-mount_option_krb_sec_remote_filesystems_action:testaction:1" question_ref="ocil:ssg-mount_option_krb_sec_remote_filesystems_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-no_insecure_locks_exports_action:testaction:1" question_ref="ocil:ssg-no_insecure_locks_exports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-use_kerberos_security_all_exports_action:testaction:1" question_ref="ocil:ssg-use_kerberos_security_all_exports_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_named_disabled_action:testaction:1" question_ref="ocil:ssg-service_named_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_bind_removed_action:testaction:1" question_ref="ocil:ssg-package_bind_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_vsftpd_disabled_action:testaction:1" question_ref="ocil:ssg-service_vsftpd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_vsftpd_removed_action:testaction:1" question_ref="ocil:ssg-package_vsftpd_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ftp_log_transactions_action:testaction:1" question_ref="ocil:ssg-ftp_log_transactions_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-ftp_present_banner_action:testaction:1" question_ref="ocil:ssg-ftp_present_banner_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_httpd_disabled_action:testaction:1" question_ref="ocil:ssg-service_httpd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_httpd_removed_action:testaction:1" question_ref="ocil:ssg-package_httpd_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_dovecot_disabled_action:testaction:1" question_ref="ocil:ssg-service_dovecot_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_dovecot_removed_action:testaction:1" question_ref="ocil:ssg-package_dovecot_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_zebra_disabled_action:testaction:1" question_ref="ocil:ssg-service_zebra_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_quagga_removed_action:testaction:1" question_ref="ocil:ssg-package_quagga_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_smb_disabled_action:testaction:1" question_ref="ocil:ssg-service_smb_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_samba_removed_action:testaction:1" question_ref="ocil:ssg-package_samba_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_samba-common_installed_action:testaction:1" question_ref="ocil:ssg-package_samba-common_installed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-require_smb_client_signing_action:testaction:1" question_ref="ocil:ssg-require_smb_client_signing_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-mount_option_smb_client_signing_action:testaction:1" question_ref="ocil:ssg-mount_option_smb_client_signing_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_squid_disabled_action:testaction:1" question_ref="ocil:ssg-service_squid_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_squid_removed_action:testaction:1" question_ref="ocil:ssg-package_squid_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-service_snmpd_disabled_action:testaction:1" question_ref="ocil:ssg-service_snmpd_disabled_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-package_net-snmp_removed_action:testaction:1" question_ref="ocil:ssg-package_net-snmp_removed_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-snmpd_use_newer_protocol_action:testaction:1" question_ref="ocil:ssg-snmpd_use_newer_protocol_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-snmpd_not_default_password_action:testaction:1" question_ref="ocil:ssg-snmpd_not_default_password_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-met_inherently_generic_action:testaction:1" question_ref="ocil:ssg-met_inherently_generic_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-met_inherently_auditing_action:testaction:1" question_ref="ocil:ssg-met_inherently_auditing_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-met_inherently_nonselected_action:testaction:1" question_ref="ocil:ssg-met_inherently_nonselected_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-unmet_nonfinding_nonselected_scope_action:testaction:1" question_ref="ocil:ssg-unmet_nonfinding_nonselected_scope_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-unmet_finding_nonselected_action:testaction:1" question_ref="ocil:ssg-unmet_finding_nonselected_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-unmet_nonfinding_scope_action:testaction:1" question_ref="ocil:ssg-unmet_nonfinding_scope_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-update_process_action:testaction:1" question_ref="ocil:ssg-update_process_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-c2s_procedural_requirement_action:testaction:1" question_ref="ocil:ssg-c2s_procedural_requirement_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
    <boolean_question_test_action id="ocil:ssg-c2s_met_inherently_action:testaction:1" question_ref="ocil:ssg-c2s_met_inherently_question:question:1">
      <when_true>
        <result>PASS</result>
      </when_true>
      <when_false>
        <result>FAIL</result>
      </when_false>
    </boolean_question_test_action>
  </test_actions>
  <questions>
    <boolean_question id="ocil:ssg-partition_for_tmp_question:question:1">
      <question_text>
            
    Run the following command to determine if /tmp 
    is on its own partition or logical volume:

  $ mount | grep "on /tmp "
  If /tmp  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-partition_for_var_question:question:1">
      <question_text>
            
    Run the following command to determine if /var 
    is on its own partition or logical volume:

  $ mount | grep "on /var "
  If /var  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-partition_for_var_log_question:question:1">
      <question_text>
            
    Run the following command to determine if /var/log 
    is on its own partition or logical volume:

  $ mount | grep "on /var/log "
  If /var/log  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-partition_for_var_log_audit_question:question:1">
      <question_text>
            
    Run the following command to determine if /var/log/audit 
    is on its own partition or logical volume:

  $ mount | grep "on /var/log/audit "
  If /var/log/audit  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-partition_for_home_question:question:1">
      <question_text>
            
    Run the following command to determine if /home 
    is on its own partition or logical volume:

  $ mount | grep "on /home "
  If /home  has its own partition or volume group, a line
  will be returned.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-encrypt_partitions_question:question:1">
      <question_text>
Check the system partitions to determine if they are encrypted with the following command:
blkid

Output will be similar to:
/dev/sda1: UUID=" ab12c3de-4f56-789a-8f33-3850cc8ce3a2
" TYPE="crypto_LUKS"
/dev/sda2: UUID=" bc98d7ef-6g54-321h-1d24-9870de2ge1a2
" TYPE="crypto_LUKS"

Pseudo-file systems, such as /proc, /sys, and tmpfs, are not required to use disk encryption and are not a finding. 

			Is it the case that partitions do not have a type of crypto_LUKS?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ensure_redhat_gpgkey_installed_question:question:1">
      <question_text>
To ensure that the GPG key is installed, run:
$ rpm -q --queryformat "%{SUMMARY}\n" gpg-pubkey
The command should return the string below:
gpg(Red Hat, Inc. (release key 2)  &lt;security@redhat.com&gt;

			Is it the case that the Red Hat GPG Key is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ensure_gpgcheck_globally_activated_question:question:1">
      <question_text>
To determine whether yum is configured to use gpgcheck,
inspect /etc/yum.conf and ensure the following appears in the
[main] section:
gpgcheck=1
A value of 1 indicates that gpgcheck is enabled. Absence of a
gpgcheck line or a setting of 0 indicates that it is
disabled.

			Is it the case that GPG checking is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ensure_gpgcheck_never_disabled_question:question:1">
      <question_text>
To determine whether yum has been configured to disable
gpgcheck for any repos,  inspect all files in
/etc/yum.repos.d and ensure the following does not appear in any
sections:
gpgcheck=0
A value of 0 indicates that gpgcheck has been disabled for that repo. 

			Is it the case that GPG checking is disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-security_patches_up_to_date_question:question:1">
      <question_text>
If the system is joined to the Red Hat Network, a Red Hat Satellite Server, or
a yum server which provides updates, invoking the following command will
indicate if updates are available:
$ sudo yum check-update

If the system is not configured to update from one of these sources,
run the following command to list when each package was last updated:
$ rpm -qa -last

Compare this to Red Hat Security Advisories (RHSA) listed at
https://access.redhat.com/security/updates/active/https://access.redhat.com/security/updates/active/
to determine if the system is missing applicable updates.

			Is it the case that updates are not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-clean_components_post_updating_question:question:1">
      <question_text>
To verify that clean_requirements_on_remove is configured properly, run the
following command:
$ grep clean_requirements_on_remove /etc/yum.conf
The output should return something similar to:
clean_requirements_on_remove=1

			Is it the case that clean_requirements_on_remove is not enabled or configured correctly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ensure_gpgcheck_local_packages_question:question:1">
      <question_text>
To verify that localpkg_gpgcheck is configured properly, run the following
command:
$ grep localpkg_gpgcheck /etc/yum.conf
The output should return something similar to:
localpkg_gpgcheck=1

			Is it the case that gpgcheck is not enabled or configured correctly to verify local packages?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ensure_gpgcheck_repo_metadata_question:question:1">
      <question_text>
To verify that repo_gpgcheck is configured properly, run the following
command:
$ grep repo_gpgcheck /etc/yum.conf
The output should return something similar to:
repo_gpgcheck=1

			Is it the case that gpgcheck is not enabled or configured correctly to verify repository metadata?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_aide_installed_question:question:1">
      <question_text>
                
    Run the following command to determine if the aide package is installed:
    $ rpm -q aide
              
			Is it the case that the package is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-aide_build_database_question:question:1">
      <question_text>
To find the location of the AIDE databse file, run the following command:
$ sudo ls -l DBDIR/database_file_name

			Is it the case that there is no database file?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-aide_periodic_cron_checking_question:question:1">
      <question_text>
To determine that periodic AIDE execution has been scheduled, run the following command:
$ grep aide /etc/crontab
The output should return some similiar to the following:
05 4 * * * root /usr/sbin/aide --check

			Is it the case that there is no output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-aide_scan_notification_question:question:1">
      <question_text>
To determine that periodic AIDE execution has been scheduled, run the following command:
$ grep aide /etc/crontab
The output should return something similar to the following:
05 4 * * * root /usr/sbin/aide --check | /bin/mail -s "$(hostname) - AIDE Integrity Check" root@localhost

			Is it the case that AIDE has not been configured or has not been configured to notify personnel of scan details?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-aide_verify_acls_question:question:1">
      <question_text>
To determine that AIDE is verifying ACLs, run the following command:
$ grep acl /etc/aide.conf
Verify that the acl option is added to the correct ruleset.

			Is it the case that the acl option is missing or not added to the correct ruleset?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-aide_verify_ext_attributes_question:question:1">
      <question_text>
To determine that AIDE is verifying extended file attributes, run the following command:
$ grep xattrs /etc/aide.conf
Verify that the xattrs option is added to the correct ruleset.

			Is it the case that the xattrs option is missing or not added to the correct ruleset?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-aide_use_fips_hashes_question:question:1">
      <question_text>
To determine that AIDE is configured for FIPS 140-2 file hashing, run the following command:
$ grep sha512 /etc/aide.conf
Verify that the sha512 option is added to the correct ruleset.

			Is it the case that the sha512 option is missing or not added to the correct ruleset?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rpm_verify_permissions_question:question:1">
      <question_text>
The following command will list which files on the system have permissions different from what
is expected by the RPM database:
$ rpm -Va | grep '^.M'

			Is it the case that there is output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rpm_verify_hashes_question:question:1">
      <question_text> The following command will list which files on the system
have file hashes different from what is expected by the RPM database.
$ rpm -Va | awk '$1 ~ /..5/ &amp;&amp; $2 != "c"'

			Is it the case that there is output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-install_hids_question:question:1">
      <question_text>
Inspect the system to determine if intrusion detection software has been installed.
Verify this intrusion detection software is active.

			Is it the case that no host-based intrusion detection tools are installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-install_antivirus_question:question:1">
      <question_text>
Inspect the system for a cron job or system service which executes
a virus scanning tool regularly.


To verify the McAfee VSEL system service is operational,
run the following command:
$ sudo /sbin/service nails status

To check on the age of uvscan virus definition files, run the following command:
$ sudo cd /opt/NAI/LinuxShield/engine/dat
$ sudo ls -la avvscan.dat avvnames.dat avvclean.dat

			Is it the case that virus scanning software does not run continuously, or at least daily, or has signatures that are out of date?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-install_mcafee_cma_rt_question:question:1">
      <question_text>
To verify that McAfee Runtime Libraries (MFErt) and Linux Agent (MFEcma)
are installed, run the following command(s):
$ rpm -q MFEcma
$ rpm -q MFErt

			Is it the case that the HBSS HIPS module is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-install_mcafee_hbss_hips_question:question:1">
      <question_text>
To verify that McAfee HIPS is installed, run the following command(s):
$ rpm -q MFEhiplsm

			Is it the case that the HBSS HIPS module is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-install_mcafee_hbss_accm_question:question:1">
      <question_text>
To verify that HBSS ACCM is installed, run the following command(s):
$ sudo ls /opt/McAfee/accm/bin/accm

			Is it the case that the HBSS ACCM module is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-install_mcafee_hbss_pa_question:question:1">
      <question_text>
To verify that HBSS PA is installed, run the following command(s):
$ sudo ls /opt/McAfee/auditengine/bin/auditmanager

			Is it the case that the HBSS PA module is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-install_mcafee_antivirus_question:question:1">
      <question_text>
To verify that McAfee VirusScan Enterprise for Linux is installed
and running, run the following command(s):
$ sudo systemctl status nails
$ rpm -q McAfeeVSEForLinux

			Is it the case that virus scanning software is not installed or running?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_nails_enabled_question:question:1">
      <question_text>
                
        Run the following command to determine the current status of the
nails service:
        $ systemctl is-active nails
        If the service is running, it should return the following: active
              
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-mcafee_antivirus_definitions_updated_question:question:1">
      <question_text>
To check on the age of McAfee virus definition files, run the following command:
$ sudo cd /opt/NAI/LinuxShield/engine/dat
$ sudo ls -la avvscan.dat avvnames.dat avvclean.dat

			Is it the case that signatures are out of date?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_dracut-fips_installed_question:question:1">
      <question_text>
              
    Run the following command to determine if the dracut-fips package is installed:
    $ rpm -q dracut-fips
            
			Is it the case that the package is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-grub2_enable_fips_mode_question:question:1">
      <question_text>
To verify that FIPS is enabled properly in grub, run the following command:
$ grep fips /etc/default/grub
The output should contain fips=1

			Is it the case that FIPS is not configured or enabled in grub?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-installed_OS_is_certified_question:question:1">
      <question_text>
To verify that the installed operating system is supported or certified, run
the following command:
$ grep -i "red hat" /etc/redhat-release
The output should contain something similar to:
Red Hat Enterprise Linux Server 7.3 (Maipo)

			Is it the case that the installed operating system is not supported or certified?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-enable_dconf_user_profile_question:question:1">
      <question_text>
To verify that the DConf User profile is configured correctly, run the following
command:
$ cat /etc/dconf/profile/user
The output should show the following:
user-db:user
system-db:local
system-db:site
system-db:distro

			Is it the case that DConf User profile does not exist or is not configured correctly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-gnome_gdm_disable_automatic_login_question:question:1">
      <question_text>
To verify that automatic logins are disabled, run the following command:
$ grep -Pzoi "^\[daemon]\\nautomaticlogin.*" /etc/gdm/custom.conf
The output should show the following:
[daemon]
AutomaticLoginEnable=false

			Is it the case that GDM allows users to automatically login?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-gnome_gdm_disable_guest_login_question:question:1">
      <question_text>
To verify that timed logins are disabled, run the following command:
$ grep -Pzoi "^\[daemon]\\ntimedlogin.*" /etc/gdm/custom.conf
The output should show the following:
[daemon]
TimedLoginEnable=false

			Is it the case that GDM allows a guest to login without credentials?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_disable_user_list_question:question:1">
      <question_text>
To ensure the user list is disabled, run the following command:
$ grep disable-user-list /etc/dconf/db/gdm.d/*
The output should be true.
To ensure that users cannot enable displaying the user list, run the following:
$ grep disable-user-list /etc/dconf/db/gdm.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/disable-user-list

			Is it the case that disable-user-list has not been configured or is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_disable_restart_shutdown_question:question:1">
      <question_text>
To ensure disable and restart on the login screen are disabled, run the following command:
$ grep disable-restart-buttons /etc/dconf/db/gdm.d/*
The output should be true.
To ensure that users cannot enable disable and restart on the login screen, run the following:
$ grep disable-restart-buttons /etc/dconf/db/gdm.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/disable-restart-buttons

			Is it the case that disable-restart-buttons has not been configured or is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_enable_smartcard_auth_question:question:1">
      <question_text>
To ensure smart card authentication on the login screen is enabled, run the following command:
$ grep enable-smartcard-authentication /etc/dconf/db/gdm.d/*
The output should be true.
To ensure that users cannot disable smart card authentication on the login screen, run the following:
$ grep enable-smartcard-authentication /etc/dconf/db/gdm.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/enable-smartcard-authentication

			Is it the case that enable-smartcard-authentication has not been configured or is disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_login_retries_question:question:1">
      <question_text>
To ensure the login screen resets after a specified number of failures,
run the following command:
$ grep allowed-failures /etc/dconf/db/gdm.d/*
The output should be 3 or less.
To ensure that users cannot change or configure the resets after a specified
number of failures on the login screen, run the following:
$ grep allowed-failures /etc/dconf/db/gdm.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/allowed-failures

			Is it the case that allowed-failures is not equal to or less than the expected value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_screensaver_idle_delay_question:question:1">
      <question_text>
To check the current idle time-out value, run the following command:
$ gsettings get org.gnome.desktop.session idle-delay
If properly configured, the output should be 'uint32 '.
To ensure that users cannot change the screensaver inactivity timeout setting, run the following:
$ grep idle-delay /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/session/idle-delay

			Is it the case that idle-delay is not equal to or less than the expected value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_screensaver_idle_activation_enabled_question:question:1">
      <question_text>
To check the screensaver mandatory use status, run the following command:
$ gsettings get org.gnome.desktop.screensaver idle-activation-enabled
If properly configured, the output should be true.
To ensure that users cannot disable the screensaver idle inactivity setting, run the following:
$ grep idle-activation-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/idle-activation-enabled

			Is it the case that idle_activation_enabled is not enabled or configured?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_screensaver_lock_enabled_question:question:1">
      <question_text>
To check the status of the idle screen lock activation, run the following command:
$ gsettings get org.gnome.desktop.screensaver lock-enabled
If properly configured, the output should be true.
To ensure that users cannot change how long until the the screensaver locks, run the following:
$ grep lock-enabled /etc/dconf/db/local.d/locks/*
If properly configured, the output for lock-enabled should be /org/gnome/desktop/screensaver/lock-enabled

			Is it the case that screensaver locking is not enabled and/or has not been set or configured correctly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_screensaver_lock_delay_question:question:1">
      <question_text>
To check that the screen locks immediately when activated, run the following command:
$ gsettings get org.gnome.desktop.screensaver lock-delay
If properly configured, the output should be 'uint32 0'.

To ensure that users cannot change how long until the the screensaver locks, run the following:
$ grep lock-delay /etc/dconf/db/local.d/locks/*
If properly configured, the output for lock-delay should be /org/gnome/desktop/screensaver/lock-delay

			Is it the case that the screensaver lock delay has not been set or configured correctly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_screensaver_mode_blank_question:question:1">
      <question_text>
To ensure the screensaver is configured to be blank, run the following command:
$ gsettings get org.gnome.desktop.screensaver picture-uri
If properly configured, the output should be ''.
To ensure that users cannot set the screensaver background, run the following:
$ grep picture-uri /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/picture-uri

			Is it the case that it is not set or configured properly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_screensaver_user_info_question:question:1">
      <question_text>
To ensure the splash screen is configured not to show user name, run the following command:
$ gsettings get org.gnome.desktop.screensaver show-full-name-in-top-bar
If properly configured, the output should be false.
To ensure that users cannot enable user name on the lock screen, run the following:
$ grep show-full-name-in-top-bar /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/screensaver/show-full-name-in-top-bar

			Is it the case that it is not set or configured properly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_session_user_locks_question:question:1">
      <question_text>
To ensure that users cannot change session idle and lock settings, run the following:
$ grep 'lock-delay\|idle-delay' /etc/dconf/db/local.d/locks/*
If properly configured, the output should return /org/gnome/desktop/screensaver/lock-delay
abd /org/gnome/desktop/session/idle-delay.

			Is it the case that GNOME3 session settings are not locked or configured properly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_disable_ctrlaltdel_reboot_question:question:1">
      <question_text>
To ensure the system is configured to ignore the Ctrl-Alt-Del sequence,
run the following command:
$ gsettings get org.gnome.settings-daemon.plugins.media-keys logout
If properly configured, the output should be ''.
To ensure that users cannot enable the Ctrl-Alt-Del sequence, run the following:
$ grep logout /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/settings-daemon/plugins/media-keys/logout

			Is it the case that GNOME3 is configured to reboot when Ctrl-Alt-Del is pressed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_disable_user_admin_question:question:1">
      <question_text>
To ensure the GUI does not allow user administratrion capabilities to all users,
run the following command:
$ gsettings get org.gnome.desktop.lockdown user-administration-disabled
If properly configured, the output should be true.
To ensure that users cannot enable user administration, run the following:
$ grep user-administration /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/desktop/lockdown/user-administration-disabled

			Is it the case that user administration is not configured or disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_disable_power_settings_question:question:1">
      <question_text>
To ensure that the GUI power settings are not active, run the following command:
$ gsettings get org.gnome.settings-daemon.plugins.power active
If properly configured, the output should be false.
To ensure that users cannot enable the power settings, run the following:
$ grep power /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/settings-daemon/plugins/power/active

			Is it the case that power settings are enabled and are not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_disable_geolocation_question:question:1">
      <question_text>
To ensure that system location tracking is not active, run the following command:
$ gsettings get org.gnome.system.location enabled
$ gsettings get org.gnome.clocks geolocation
If properly configured, the output should be false.
To ensure that users cannot enable system location tracking, run the following:
$ grep location /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/system/location/enabled and /org/gnome/clocks/geolocation.

			Is it the case that geolocation is enabled and not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_disable_wifi_create_question:question:1">
      <question_text>
To ensure that WIFI connections caanot be created, run the following command:
$ gsettings get org.gnome.nm-applet disable-wifi-create
If properly configured, the output should be true.
To ensure that users cannot enable WIFI connection creation, run the following:
$ grep wifi-create /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/nm-applet/disable-wifi-create

			Is it the case that WIFI connections can be created through GNOME?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_disable_wifi_notification_question:question:1">
      <question_text>
To ensure that wireless network notification is disabled, run the following command:
$ gsettings get org.gnome.nm-applet suppress-wireless-networks-available
If properly configured, the output should be true.
To ensure that users cannot enable wireless notification, run the following:
$ grep wireless-networks-available /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/nm-applet/suppress-wireless-networks-available

			Is it the case that wireless network notification is enabled and not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_remote_access_credential_prompt_question:question:1">
      <question_text>
To ensure that remote access requires credentials, run the following command:
$ gsettings get org.gnome.Vino authentication-methods
If properly configured, the output should be false.
To ensure that users cannot disable credentials for remote access, run the following:
$ grep authentication-methods /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/Vino/authentication-methods

			Is it the case that wireless network notification is enabled and not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_remote_access_encryption_question:question:1">
      <question_text>
To ensure that remote access connections are encrypted, run the following command:
$ gsettings get org.gnome.Vino require-encrpytion
If properly configured, the output should be true.
To ensure that users cannot disable encrypted remote connections, run the following:
$ grep require-encryption /etc/dconf/db/local.d/locks/*
If properly configured, the output should be
/org/gnome/Vino/require-encryption

			Is it the case that remote access connections are not encrypted?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_disable_automount_question:question:1">
      <question_text>
These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.media-handling automount
$ gsettings get org.gnome.desktop.media-handling automount-open
$ gsettings get org.gnome.desktop.media-handling autorun-never
If properly configured, the output for automount should be false.
If properly configured, the output for automount-openshould be false.
If properly configured, the output for autorun-never should be true.
To ensure that users cannot enable automount and autorun in GNOME3, run the following:
$ grep 'automount\|autorun' /etc/dconf/db/local.d/locks/*
If properly configured, the output for automount should be /org/gnome/desktop/media-handling/automount
If properly configured, the output for automount-open should be /org/gnome/desktop/media-handling/auto-open
If properly configured, the output for autorun-never should be /org/gnome/desktop/media-handling/autorun-never

			Is it the case that GNOME automounting is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_disable_thumbnailers_question:question:1">
      <question_text>
These settings can be verified by running the following:
$ gsettings get org.gnome.desktop.thumbnailers disable-all
If properly configured, the output should be true.
To ensure that users cannot how long until the the screensaver locks, run the following:
$ grep disable-all /etc/dconf/db/local.d/locks/*
If properly configured, the output should be /org/gnome/desktop/thumbnailers/disable-all

			Is it the case that GNOME thumbnailers are not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sudo_remove_nopasswd_question:question:1">
      <question_text>
To determine if NOPASSWD has been configured for sudo, run the following command:
$ sudo grep -ri nopasswd /etc/sudoers /etc/sudoers.d/
The command should return no output.

			Is it the case that nopasswd is enabled in sudo?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sudo_remove_no_authenticate_question:question:1">
      <question_text>
To determine if !authenticate has not been configured for sudo, run the following command:
$ sudo grep -r \!authenticate /etc/sudoers /etc/sudoers.d/
The command should return no output.

			Is it the case that !authenticate is enabled in sudo?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-mount_option_noexec_removable_partitions_question:question:1">
      <question_text>
To verify that binaries cannot be directly executed from removable media, run the following command:
$ grep -v noexec /etc/fstab
The resulting output will show partitions which do not have the noexec flag. Verify all partitions
in the output are not removable media.

			Is it the case that removable media partitions are present?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-kernel_module_usb-storage_disabled_question:question:1">
      <question_text>
            
If the system is configured to prevent the loading of the
usb-storage kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as
/bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d
and the deprecated /etc/modprobe.conf:
preserve$ grep -r usb-storage /etc/modprobe.conf /etc/modprobe.d
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_autofs_disabled_question:question:1">
      <question_text>
            
        To check that the autofs service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled autofs
        Output should indicate the autofs service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled autofsdisabled

        Run the following command to verify autofs is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active autofs

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-userowner_shadow_file_question:question:1">
      <question_text>
              
    To check the ownership of /etc/shadow, run the command:
    $ ls -lL /etc/shadow
    If properly configured, the output should indicate the following owner:
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-groupowner_shadow_file_question:question:1">
      <question_text>
              
    To check the group ownership of /etc/shadow, run the command:
    $ ls -lL /etc/shadow
    If properly configured, the output should indicate the following group-owner.
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_etc_shadow_question:question:1">
      <question_text>
              
    To check the permissions of /etc/shadow, run the command:
    $ ls -l /etc/shadow
    If properly configured, the output should indicate the following permissions:
    ----------
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_owner_etc_group_question:question:1">
      <question_text>
              
    To check the ownership of /etc/group, run the command:
    $ ls -lL /etc/group
    If properly configured, the output should indicate the following owner:
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_groupowner_etc_group_question:question:1">
      <question_text>
              
    To check the group ownership of /etc/group, run the command:
    $ ls -lL /etc/group
    If properly configured, the output should indicate the following group-owner.
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_etc_group_question:question:1">
      <question_text>
              
    To check the permissions of /etc/group, run the command:
    $ ls -l /etc/group
    If properly configured, the output should indicate the following permissions:
    -rw-r--r--
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_owner_etc_gshadow_question:question:1">
      <question_text>
              
    To check the ownership of /etc/gshadow, run the command:
    $ ls -lL /etc/gshadow
    If properly configured, the output should indicate the following owner:
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_groupowner_etc_gshadow_question:question:1">
      <question_text>
              
    To check the group ownership of /etc/gshadow, run the command:
    $ ls -lL /etc/gshadow
    If properly configured, the output should indicate the following group-owner.
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_etc_gshadow_question:question:1">
      <question_text>
              
    To check the permissions of /etc/gshadow, run the command:
    $ ls -l /etc/gshadow
    If properly configured, the output should indicate the following permissions:
    ----------
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_owner_etc_passwd_question:question:1">
      <question_text>
              
    To check the ownership of /etc/passwd, run the command:
    $ ls -lL /etc/passwd
    If properly configured, the output should indicate the following owner:
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_groupowner_etc_passwd_question:question:1">
      <question_text>
              
    To check the group ownership of /etc/passwd, run the command:
    $ ls -lL /etc/passwd
    If properly configured, the output should indicate the following group-owner.
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_etc_passwd_question:question:1">
      <question_text>
              
    To check the permissions of /etc/passwd, run the command:
    $ ls -l /etc/passwd
    If properly configured, the output should indicate the following permissions:
    -rw-r--r--
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_library_dirs_question:question:1">
      <question_text>
Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64

To find shared libraries that are group-writable or world-writable,
run the following command for each directory DIR which contains shared libraries:
$ sudo find -L DIR -perm /022 -type f

			Is it the case that any of these files are group-writable or world-writable?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_ownership_library_dirs_question:question:1">
      <question_text>
Shared libraries are stored in the following directories:
/lib
/lib64
/usr/lib
/usr/lib64

For each of these directories, run the following command to find files not 
owned by root:
$ sudo find -L $DIR \! -user root -exec chown root {} \;

			Is it the case that any of these files are not owned by root?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_binary_dirs_question:question:1">
      <question_text>
System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
To find system executables that are group-writable or world-writable,
run the following command for each directory DIR which contains system executables:
$ sudo find -L DIR -perm /022 -type f

			Is it the case that any system executables are found to be group or world writable?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_ownership_binary_dirs_question:question:1">
      <question_text>
System executables are stored in the following directories by default:
/bin
/sbin
/usr/bin
/usr/libexec
/usr/local/bin
/usr/local/sbin
/usr/sbin
To find system executables that are not owned by root,
run the following command for each directory DIR which contains system executables:
$ sudo find DIR/ \! -user root

			Is it the case that any system executables are found to not be owned by root?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dir_perms_world_writable_sticky_bits_question:question:1">
      <question_text>
To find world-writable directories that lack the sticky bit, run the following command:
$ sudo find / -xdev -type d -perm 002 ! -perm 1000

			Is it the case that any world-writable directories are missing the sticky bit?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_unauthorized_world_writable_question:question:1">
      <question_text>
To find world-writable files, run the following command:
$ sudo find / -xdev -type f -perm -002

			Is it the case that there is output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_unauthorized_sgid_question:question:1">
      <question_text>
To find world-writable files, run the following command:
$ sudo find / -xdev -type f -perm -002

			Is it the case that there is output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_unauthorized_suid_question:question:1">
      <question_text>
To find world-writable files, run the following command:
$ sudo find / -xdev -type f -perm -002

			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-no_files_unowned_by_user_question:question:1">
      <question_text>
The following command will discover and print any
files on local partitions which do not belong to a valid user.
$ sudo find / -xdev -fstype local -nouser

Either remove all files and directories from the system that do not have a
valid user, or assign a valid user to all unowned files and directories on
the system with the chown command:
$ sudo chown user file

			Is it the case that files exist that are not owned by a valid user?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_ungroupowned_question:question:1">
      <question_text>
The following command will discover and print any
files on local partitions which do not belong to a valid group.
$ sudo find / -xdev -fstype local -nogroup

Either remove all files and directories from the system that do not have a valid group,
or assign a valid group with the chgrp command:
$ sudo chgrp group file

			Is it the case that there is output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dir_perms_world_writable_system_owned_question:question:1">
      <question_text>
The following command will discover and print world-writable directories that
are not owned by a system account, given the assumption that only system
accounts have a uid lower than 500.  Run it once for each local partition PART:
$ sudo find PART -xdev -type d -perm -0002 -uid +499 -print

			Is it the case that there is output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-umask_for_daemons_question:question:1">
      <question_text>
To check the value of the umask, run the following command:
$ grep umask /etc/init.d/functions
The output should show either 022 or 027.

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-disable_users_coredumps_question:question:1">
      <question_text>
To verify that core dumps are disabled for all users, run the following command:
$ grep core /etc/security/limits.conf
The output should be:
*     hard   core    0

			Is it the case that it is not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_fs_suid_dumpable_question:question:1">
      <question_text>
              
    The status of the fs.suid_dumpable kernel parameter can be queried
    by running the following command:
    preserve$ sysctl fs.suid_dumpable
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_kernel_exec_shield_question:question:1">
      <question_text>
To verify ExecShield is enabled on 64-bit Red Hat Enterprise Linux 7 systems,
run the following command:
$ dmesg | grep '[NX|DX]*protection'
The output should not contain 'disabled by kernel command line option'.
To verify that ExecShield has not been disabled in the kernel configuration,
run the following command:
$ sudo grep noexec /boot/grub2/grub.cfg
The output should not return noexec=off.
For 32-bit Red Hat Enterprise Linux 7 systems, run the following command:
$ sysctl kernel.exec-shield
The output should be:

    To set the runtime status of the kernel.exec-shield kernel parameter,
    run the following command:
    preserve$ sudo sysctl -w kernel.exec-shield=1
    If this is not the system's default value, add the following line to /etc/sysctl.conf:
    preservekernel.exec-shield = 1

			Is it the case that ExecShield is not supported by the hardware, is not enabled, or has been disabled by the kernel configuration.?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_kernel_randomize_va_space_question:question:1">
      <question_text>
              
    The status of the kernel.randomize_va_space kernel parameter can be queried
    by running the following command:
    preserve$ sysctl kernel.randomize_va_space
    The output of the command should indicate a value of 2.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_kernel_dmesg_restrict_question:question:1">
      <question_text>
            
    The status of the kernel.dmesg_restrict kernel parameter can be queried
    by running the following command:
    preserve$ sysctl kernel.dmesg_restrict
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
          
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-enable_selinux_bootloader_question:question:1">
      <question_text>
Inspect /etc/default/grub for any instances of selinux=0
in the kernel boot arguments.  Presence of selinux=0 indicates
that SELinux is disabled at boot time.

			Is it the case that SELinux is disabled at boot time?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-selinux_state_question:question:1">
      <question_text>
Check the file /etc/selinux/config and ensure the following line appears:
SELINUX=

			Is it the case that SELINUX is not set to enforcing?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-selinux_policytype_question:question:1">
      <question_text>
Check the file /etc/selinux/config and ensure the following line appears:
SELINUXTYPE=

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-selinux_all_devicefiles_labeled_question:question:1">
      <question_text>To check for unlabeled device files, run the following command:
$ sudo find /dev -context *:device_t:* \( -type c -o -type b \) -printf "%p %Z\n"
It should produce no output in a well-configured system.
			Is it the case that there is output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_abrt_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the abrt_anon_write SELinux boolean is disabled:
        $ getsebool abrt_anon_write
        If properly configured, the output should show the following:
        abrt_anon_write --&gt; off
          
			Is it the case that abrt_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_abrt_handle_event_question:question:1">
      <question_text>
            
        Run the following command to determine if the abrt_handle_event SELinux boolean is disabled:
        $ getsebool abrt_handle_event
        If properly configured, the output should show the following:
        abrt_handle_event --&gt; off
          
			Is it the case that abrt_handle_event is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_abrt_upload_watch_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the abrt_upload_watch_anon_write SELinux boolean is disabled:
        $ getsebool abrt_upload_watch_anon_write
        If properly configured, the output should show the following:
        abrt_upload_watch_anon_write --&gt; off
          
			Is it the case that abrt_upload_watch_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_antivirus_can_scan_system_question:question:1">
      <question_text>
            
        Run the following command to determine if the antivirus_can_scan_system SELinux boolean is enabled:
        $ getsebool antivirus_can_scan_system
        If properly configured, the output should show the following:
        antivirus_can_scan_system --&gt; on
          
			Is it the case that antivirus_can_scan_system is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_antivirus_use_jit_question:question:1">
      <question_text>
            
        Run the following command to determine if the antivirus_use_jit SELinux boolean is disabled:
        $ getsebool antivirus_use_jit
        If properly configured, the output should show the following:
        antivirus_use_jit --&gt; off
          
			Is it the case that antivirus_use_jit is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_auditadm_exec_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the auditadm_exec_content SELinux boolean is enabled:
        $ getsebool auditadm_exec_content
        If properly configured, the output should show the following:
        auditadm_exec_content --&gt; on
          
			Is it the case that auditadm_exec_content is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_authlogin_nsswitch_use_ldap_question:question:1">
      <question_text>
            
        Run the following command to determine if the authlogin_nsswitch_use_ldap SELinux boolean is disabled:
        $ getsebool authlogin_nsswitch_use_ldap
        If properly configured, the output should show the following:
        authlogin_nsswitch_use_ldap --&gt; off
          
			Is it the case that authlogin_nsswitch_use_ldap is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_authlogin_radius_question:question:1">
      <question_text>
            
        Run the following command to determine if the authlogin_radius SELinux boolean is disabled:
        $ getsebool authlogin_radius
        If properly configured, the output should show the following:
        authlogin_radius --&gt; off
          
			Is it the case that authlogin_radius is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_authlogin_yubikey_question:question:1">
      <question_text>
            
        Run the following command to determine if the authlogin_yubikey SELinux boolean is disabled:
        $ getsebool authlogin_yubikey
        If properly configured, the output should show the following:
        authlogin_yubikey --&gt; off
          
			Is it the case that authlogin_yubikey is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_awstats_purge_apache_log_files_question:question:1">
      <question_text>
            
        Run the following command to determine if the awstats_purge_apache_log_files SELinux boolean is disabled:
        $ getsebool awstats_purge_apache_log_files
        If properly configured, the output should show the following:
        awstats_purge_apache_log_files --&gt; off
          
			Is it the case that awstats_purge_apache_log_files is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_boinc_execmem_question:question:1">
      <question_text>
            
        Run the following command to determine if the boinc_execmem SELinux boolean is disabled:
        $ getsebool boinc_execmem
        If properly configured, the output should show the following:
        boinc_execmem --&gt; off
          
			Is it the case that boinc_execmem is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cdrecord_read_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the cdrecord_read_content SELinux boolean is disabled:
        $ getsebool cdrecord_read_content
        If properly configured, the output should show the following:
        cdrecord_read_content --&gt; off
          
			Is it the case that cdrecord_read_content is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cluster_can_network_connect_question:question:1">
      <question_text>
            
        Run the following command to determine if the cluster_can_network_connect SELinux boolean is disabled:
        $ getsebool cluster_can_network_connect
        If properly configured, the output should show the following:
        cluster_can_network_connect --&gt; off
          
			Is it the case that cluster_can_network_connect is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cluster_manage_all_files_question:question:1">
      <question_text>
            
        Run the following command to determine if the cluster_manage_all_files SELinux boolean is disabled:
        $ getsebool cluster_manage_all_files
        If properly configured, the output should show the following:
        cluster_manage_all_files --&gt; off
          
			Is it the case that cluster_manage_all_files is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cluster_use_execmem_question:question:1">
      <question_text>
            
        Run the following command to determine if the cluster_use_execmem SELinux boolean is disabled:
        $ getsebool cluster_use_execmem
        If properly configured, the output should show the following:
        cluster_use_execmem --&gt; off
          
			Is it the case that cluster_use_execmem is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cobbler_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the cobbler_anon_write SELinux boolean is disabled:
        $ getsebool cobbler_anon_write
        If properly configured, the output should show the following:
        cobbler_anon_write --&gt; off
          
			Is it the case that cobbler_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cobbler_can_network_connect_question:question:1">
      <question_text>
            
        Run the following command to determine if the cobbler_can_network_connect SELinux boolean is disabled:
        $ getsebool cobbler_can_network_connect
        If properly configured, the output should show the following:
        cobbler_can_network_connect --&gt; off
          
			Is it the case that cobbler_can_network_connect is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cobbler_use_cifs_question:question:1">
      <question_text>
            
        Run the following command to determine if the cobbler_use_cifs SELinux boolean is disabled:
        $ getsebool cobbler_use_cifs
        If properly configured, the output should show the following:
        cobbler_use_cifs --&gt; off
          
			Is it the case that cobbler_use_cifs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cobbler_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the cobbler_use_nfs SELinux boolean is disabled:
        $ getsebool cobbler_use_nfs
        If properly configured, the output should show the following:
        cobbler_use_nfs --&gt; off
          
			Is it the case that cobbler_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_collectd_tcp_network_connect_question:question:1">
      <question_text>
            
        Run the following command to determine if the collectd_tcp_network_connect SELinux boolean is disabled:
        $ getsebool collectd_tcp_network_connect
        If properly configured, the output should show the following:
        collectd_tcp_network_connect --&gt; off
          
			Is it the case that collectd_tcp_network_connect is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_condor_tcp_network_connect_question:question:1">
      <question_text>
            
        Run the following command to determine if the condor_tcp_network_connect SELinux boolean is disabled:
        $ getsebool condor_tcp_network_connect
        If properly configured, the output should show the following:
        condor_tcp_network_connect --&gt; off
          
			Is it the case that condor_tcp_network_connect is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_conman_can_network_question:question:1">
      <question_text>
            
        Run the following command to determine if the conman_can_network SELinux boolean is disabled:
        $ getsebool conman_can_network
        If properly configured, the output should show the following:
        conman_can_network --&gt; off
          
			Is it the case that conman_can_network is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cron_can_relabel_question:question:1">
      <question_text>
            
        Run the following command to determine if the cron_can_relabel SELinux boolean is disabled:
        $ getsebool cron_can_relabel
        If properly configured, the output should show the following:
        cron_can_relabel --&gt; off
          
			Is it the case that cron_can_relabel is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cron_system_cronjob_use_shares_question:question:1">
      <question_text>
            
        Run the following command to determine if the cron_system_cronjob_use_shares SELinux boolean is disabled:
        $ getsebool cron_system_cronjob_use_shares
        If properly configured, the output should show the following:
        cron_system_cronjob_use_shares --&gt; off
          
			Is it the case that cron_system_cronjob_use_shares is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cron_userdomain_transition_question:question:1">
      <question_text>
            
        Run the following command to determine if the cron_userdomain_transition SELinux boolean is enabled:
        $ getsebool cron_userdomain_transition
        If properly configured, the output should show the following:
        cron_userdomain_transition --&gt; on
          
			Is it the case that cron_userdomain_transition is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cups_execmem_question:question:1">
      <question_text>
            
        Run the following command to determine if the cups_execmem SELinux boolean is disabled:
        $ getsebool cups_execmem
        If properly configured, the output should show the following:
        cups_execmem --&gt; off
          
			Is it the case that cups_execmem is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_cvs_read_shadow_question:question:1">
      <question_text>
            
        Run the following command to determine if the cvs_read_shadow SELinux boolean is disabled:
        $ getsebool cvs_read_shadow
        If properly configured, the output should show the following:
        cvs_read_shadow --&gt; off
          
			Is it the case that cvs_read_shadow is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_daemons_dump_core_question:question:1">
      <question_text>
            
        Run the following command to determine if the daemons_dump_core SELinux boolean is disabled:
        $ getsebool daemons_dump_core
        If properly configured, the output should show the following:
        daemons_dump_core --&gt; off
          
			Is it the case that daemons_dump_core is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_daemons_enable_cluster_mode_question:question:1">
      <question_text>
            
        Run the following command to determine if the daemons_enable_cluster_mode SELinux boolean is disabled:
        $ getsebool daemons_enable_cluster_mode
        If properly configured, the output should show the following:
        daemons_enable_cluster_mode --&gt; off
          
			Is it the case that daemons_enable_cluster_mode is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_daemons_use_tcp_wrapper_question:question:1">
      <question_text>
            
        Run the following command to determine if the daemons_use_tcp_wrapper SELinux boolean is disabled:
        $ getsebool daemons_use_tcp_wrapper
        If properly configured, the output should show the following:
        daemons_use_tcp_wrapper --&gt; off
          
			Is it the case that daemons_use_tcp_wrapper is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_daemons_use_tty_question:question:1">
      <question_text>
            
        Run the following command to determine if the daemons_use_tty SELinux boolean is disabled:
        $ getsebool daemons_use_tty
        If properly configured, the output should show the following:
        daemons_use_tty --&gt; off
          
			Is it the case that daemons_use_tty is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_dbadm_exec_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the dbadm_exec_content SELinux boolean is enabled:
        $ getsebool dbadm_exec_content
        If properly configured, the output should show the following:
        dbadm_exec_content --&gt; on
          
			Is it the case that dbadm_exec_content is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_dbadm_manage_user_files_question:question:1">
      <question_text>
            
        Run the following command to determine if the dbadm_manage_user_files SELinux boolean is disabled:
        $ getsebool dbadm_manage_user_files
        If properly configured, the output should show the following:
        dbadm_manage_user_files --&gt; off
          
			Is it the case that dbadm_manage_user_files is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_dbadm_read_user_files_question:question:1">
      <question_text>
            
        Run the following command to determine if the dbadm_read_user_files SELinux boolean is disabled:
        $ getsebool dbadm_read_user_files
        If properly configured, the output should show the following:
        dbadm_read_user_files --&gt; off
          
			Is it the case that dbadm_read_user_files is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_deny_execmem_question:question:1">
      <question_text>
            
        Run the following command to determine if the deny_execmem SELinux boolean is disabled:
        $ getsebool deny_execmem
        If properly configured, the output should show the following:
        deny_execmem --&gt; off
          
			Is it the case that deny_execmem is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_deny_ptrace_question:question:1">
      <question_text>
            
        Run the following command to determine if the deny_ptrace SELinux boolean is disabled:
        $ getsebool deny_ptrace
        If properly configured, the output should show the following:
        deny_ptrace --&gt; off
          
			Is it the case that deny_ptrace is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_dhcpc_exec_iptables_question:question:1">
      <question_text>
            
        Run the following command to determine if the dhcpc_exec_iptables SELinux boolean is disabled:
        $ getsebool dhcpc_exec_iptables
        If properly configured, the output should show the following:
        dhcpc_exec_iptables --&gt; off
          
			Is it the case that dhcpc_exec_iptables is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_dhcpd_use_ldap_question:question:1">
      <question_text>
            
        Run the following command to determine if the dhcpd_use_ldap SELinux boolean is disabled:
        $ getsebool dhcpd_use_ldap
        If properly configured, the output should show the following:
        dhcpd_use_ldap --&gt; off
          
			Is it the case that dhcpd_use_ldap is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_docker_connect_any_question:question:1">
      <question_text>
            
        Run the following command to determine if the docker_connect_any SELinux boolean is disabled:
        $ getsebool docker_connect_any
        If properly configured, the output should show the following:
        docker_connect_any --&gt; off
          
			Is it the case that docker_connect_any is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_docker_transition_unconfined_question:question:1">
      <question_text>
            
        Run the following command to determine if the docker_transition_unconfined SELinux boolean is enabled:
        $ getsebool docker_transition_unconfined
        If properly configured, the output should show the following:
        docker_transition_unconfined --&gt; on
          
			Is it the case that docker_transition_unconfined is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_domain_fd_use_question:question:1">
      <question_text>
            
        Run the following command to determine if the domain_fd_use SELinux boolean is enabled:
        $ getsebool domain_fd_use
        If properly configured, the output should show the following:
        domain_fd_use --&gt; on
          
			Is it the case that domain_fd_use is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_domain_kernel_load_modules_question:question:1">
      <question_text>
            
        Run the following command to determine if the domain_kernel_load_modules SELinux boolean is disabled:
        $ getsebool domain_kernel_load_modules
        If properly configured, the output should show the following:
        domain_kernel_load_modules --&gt; off
          
			Is it the case that domain_kernel_load_modules is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_entropyd_use_audio_question:question:1">
      <question_text>
            
        Run the following command to determine if the entropyd_use_audio SELinux boolean is disabled:
        $ getsebool entropyd_use_audio
        If properly configured, the output should show the following:
        entropyd_use_audio --&gt; off
          
			Is it the case that entropyd_use_audio is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_exim_can_connect_db_question:question:1">
      <question_text>
            
        Run the following command to determine if the exim_can_connect_db SELinux boolean is disabled:
        $ getsebool exim_can_connect_db
        If properly configured, the output should show the following:
        exim_can_connect_db --&gt; off
          
			Is it the case that exim_can_connect_db is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_exim_manage_user_files_question:question:1">
      <question_text>
            
        Run the following command to determine if the exim_manage_user_files SELinux boolean is disabled:
        $ getsebool exim_manage_user_files
        If properly configured, the output should show the following:
        exim_manage_user_files --&gt; off
          
			Is it the case that exim_manage_user_files is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_exim_read_user_files_question:question:1">
      <question_text>
            
        Run the following command to determine if the exim_read_user_files SELinux boolean is disabled:
        $ getsebool exim_read_user_files
        If properly configured, the output should show the following:
        exim_read_user_files --&gt; off
          
			Is it the case that exim_read_user_files is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_fcron_crond_question:question:1">
      <question_text>
            
        Run the following command to determine if the fcron_crond SELinux boolean is disabled:
        $ getsebool fcron_crond
        If properly configured, the output should show the following:
        fcron_crond --&gt; off
          
			Is it the case that fcron_crond is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_fenced_can_network_connect_question:question:1">
      <question_text>
            
        Run the following command to determine if the fenced_can_network_connect SELinux boolean is disabled:
        $ getsebool fenced_can_network_connect
        If properly configured, the output should show the following:
        fenced_can_network_connect --&gt; off
          
			Is it the case that fenced_can_network_connect is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_fenced_can_ssh_question:question:1">
      <question_text>
            
        Run the following command to determine if the fenced_can_ssh SELinux boolean is disabled:
        $ getsebool fenced_can_ssh
        If properly configured, the output should show the following:
        fenced_can_ssh --&gt; off
          
			Is it the case that fenced_can_ssh is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_fips_mode_question:question:1">
      <question_text>
            
        Run the following command to determine if the fips_mode SELinux boolean is enabled:
        $ getsebool fips_mode
        If properly configured, the output should show the following:
        fips_mode --&gt; on
          
			Is it the case that fips_mode is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ftpd_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the ftpd_anon_write SELinux boolean is disabled:
        $ getsebool ftpd_anon_write
        If properly configured, the output should show the following:
        ftpd_anon_write --&gt; off
          
			Is it the case that ftpd_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ftpd_connect_all_unreserved_question:question:1">
      <question_text>
            
        Run the following command to determine if the ftpd_connect_all_unreserved SELinux boolean is disabled:
        $ getsebool ftpd_connect_all_unreserved
        If properly configured, the output should show the following:
        ftpd_connect_all_unreserved --&gt; off
          
			Is it the case that ftpd_connect_all_unreserved is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ftpd_connect_db_question:question:1">
      <question_text>
            
        Run the following command to determine if the ftpd_connect_db SELinux boolean is disabled:
        $ getsebool ftpd_connect_db
        If properly configured, the output should show the following:
        ftpd_connect_db --&gt; off
          
			Is it the case that ftpd_connect_db is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ftpd_full_access_question:question:1">
      <question_text>
            
        Run the following command to determine if the ftpd_full_access SELinux boolean is disabled:
        $ getsebool ftpd_full_access
        If properly configured, the output should show the following:
        ftpd_full_access --&gt; off
          
			Is it the case that ftpd_full_access is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ftpd_use_cifs_question:question:1">
      <question_text>
            
        Run the following command to determine if the ftpd_use_cifs SELinux boolean is disabled:
        $ getsebool ftpd_use_cifs
        If properly configured, the output should show the following:
        ftpd_use_cifs --&gt; off
          
			Is it the case that ftpd_use_cifs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ftpd_use_fusefs_question:question:1">
      <question_text>
            
        Run the following command to determine if the ftpd_use_fusefs SELinux boolean is disabled:
        $ getsebool ftpd_use_fusefs
        If properly configured, the output should show the following:
        ftpd_use_fusefs --&gt; off
          
			Is it the case that ftpd_use_fusefs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ftpd_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the ftpd_use_nfs SELinux boolean is disabled:
        $ getsebool ftpd_use_nfs
        If properly configured, the output should show the following:
        ftpd_use_nfs --&gt; off
          
			Is it the case that ftpd_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ftpd_use_passive_mode_question:question:1">
      <question_text>
            
        Run the following command to determine if the ftpd_use_passive_mode SELinux boolean is disabled:
        $ getsebool ftpd_use_passive_mode
        If properly configured, the output should show the following:
        ftpd_use_passive_mode --&gt; off
          
			Is it the case that ftpd_use_passive_mode is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ftp_home_dir_question:question:1">
      <question_text>
            
        Run the following command to determine if the ftp_home_dir SELinux boolean is disabled:
        $ getsebool ftp_home_dir
        If properly configured, the output should show the following:
        ftp_home_dir --&gt; off
          
			Is it the case that ftp_home_dir is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_git_cgi_enable_homedirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the git_cgi_enable_homedirs SELinux boolean is disabled:
        $ getsebool git_cgi_enable_homedirs
        If properly configured, the output should show the following:
        git_cgi_enable_homedirs --&gt; off
          
			Is it the case that git_cgi_enable_homedirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_git_cgi_use_cifs_question:question:1">
      <question_text>
            
        Run the following command to determine if the git_cgi_use_cifs SELinux boolean is disabled:
        $ getsebool git_cgi_use_cifs
        If properly configured, the output should show the following:
        git_cgi_use_cifs --&gt; off
          
			Is it the case that git_cgi_use_cifs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_git_cgi_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the git_cgi_use_nfs SELinux boolean is disabled:
        $ getsebool git_cgi_use_nfs
        If properly configured, the output should show the following:
        git_cgi_use_nfs --&gt; off
          
			Is it the case that git_cgi_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_gitosis_can_sendmail_question:question:1">
      <question_text>
            
        Run the following command to determine if the gitosis_can_sendmail SELinux boolean is disabled:
        $ getsebool gitosis_can_sendmail
        If properly configured, the output should show the following:
        gitosis_can_sendmail --&gt; off
          
			Is it the case that gitosis_can_sendmail is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_git_session_bind_all_unreserved_ports_question:question:1">
      <question_text>
            
        Run the following command to determine if the git_session_bind_all_unreserved_ports SELinux boolean is disabled:
        $ getsebool git_session_bind_all_unreserved_ports
        If properly configured, the output should show the following:
        git_session_bind_all_unreserved_ports --&gt; off
          
			Is it the case that git_session_bind_all_unreserved_ports is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_git_session_users_question:question:1">
      <question_text>
            
        Run the following command to determine if the git_session_users SELinux boolean is disabled:
        $ getsebool git_session_users
        If properly configured, the output should show the following:
        git_session_users --&gt; off
          
			Is it the case that git_session_users is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_git_system_enable_homedirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the git_system_enable_homedirs SELinux boolean is disabled:
        $ getsebool git_system_enable_homedirs
        If properly configured, the output should show the following:
        git_system_enable_homedirs --&gt; off
          
			Is it the case that git_system_enable_homedirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_git_system_use_cifs_question:question:1">
      <question_text>
            
        Run the following command to determine if the git_system_use_cifs SELinux boolean is disabled:
        $ getsebool git_system_use_cifs
        If properly configured, the output should show the following:
        git_system_use_cifs --&gt; off
          
			Is it the case that git_system_use_cifs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_git_system_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the git_system_use_nfs SELinux boolean is disabled:
        $ getsebool git_system_use_nfs
        If properly configured, the output should show the following:
        git_system_use_nfs --&gt; off
          
			Is it the case that git_system_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_glance_api_can_network_question:question:1">
      <question_text>
            
        Run the following command to determine if the glance_api_can_network SELinux boolean is disabled:
        $ getsebool glance_api_can_network
        If properly configured, the output should show the following:
        glance_api_can_network --&gt; off
          
			Is it the case that glance_api_can_network is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_glance_use_execmem_question:question:1">
      <question_text>
            
        Run the following command to determine if the glance_use_execmem SELinux boolean is disabled:
        $ getsebool glance_use_execmem
        If properly configured, the output should show the following:
        glance_use_execmem --&gt; off
          
			Is it the case that glance_use_execmem is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_glance_use_fusefs_question:question:1">
      <question_text>
            
        Run the following command to determine if the glance_use_fusefs SELinux boolean is disabled:
        $ getsebool glance_use_fusefs
        If properly configured, the output should show the following:
        glance_use_fusefs --&gt; off
          
			Is it the case that glance_use_fusefs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_global_ssp_question:question:1">
      <question_text>
            
        Run the following command to determine if the global_ssp SELinux boolean is disabled:
        $ getsebool global_ssp
        If properly configured, the output should show the following:
        global_ssp --&gt; off
          
			Is it the case that global_ssp is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_gluster_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the gluster_anon_write SELinux boolean is disabled:
        $ getsebool gluster_anon_write
        If properly configured, the output should show the following:
        gluster_anon_write --&gt; off
          
			Is it the case that gluster_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_gluster_export_all_ro_question:question:1">
      <question_text>
            
        Run the following command to determine if the gluster_export_all_ro SELinux boolean is disabled:
        $ getsebool gluster_export_all_ro
        If properly configured, the output should show the following:
        gluster_export_all_ro --&gt; off
          
			Is it the case that gluster_export_all_ro is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_gluster_export_all_rw_question:question:1">
      <question_text>
            
        Run the following command to determine if the gluster_export_all_rw SELinux boolean is disabled:
        $ getsebool gluster_export_all_rw
        If properly configured, the output should show the following:
        gluster_export_all_rw --&gt; off
          
			Is it the case that gluster is in user or gluster_export_all_rw is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_gpg_web_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the gpg_web_anon_write SELinux boolean is disabled:
        $ getsebool gpg_web_anon_write
        If properly configured, the output should show the following:
        gpg_web_anon_write --&gt; off
          
			Is it the case that gpg_web_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_gssd_read_tmp_question:question:1">
      <question_text>
            
        Run the following command to determine if the gssd_read_tmp SELinux boolean is enabled:
        $ getsebool gssd_read_tmp
        If properly configured, the output should show the following:
        gssd_read_tmp --&gt; on
          
			Is it the case that gssd_read_tmp is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_guest_exec_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the guest_exec_content SELinux boolean is enabled:
        $ getsebool guest_exec_content
        If properly configured, the output should show the following:
        guest_exec_content --&gt; on
          
			Is it the case that guest_exec_content is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_haproxy_connect_any_question:question:1">
      <question_text>
            
        Run the following command to determine if the haproxy_connect_any SELinux boolean is disabled:
        $ getsebool haproxy_connect_any
        If properly configured, the output should show the following:
        haproxy_connect_any --&gt; off
          
			Is it the case that haproxy_connect_any is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_anon_write SELinux boolean is disabled:
        $ getsebool httpd_anon_write
        If properly configured, the output should show the following:
        httpd_anon_write --&gt; off
          
			Is it the case that httpd_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_builtin_scripting_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_builtin_scripting SELinux boolean is disabled:
        $ getsebool httpd_builtin_scripting
        If properly configured, the output should show the following:
        httpd_builtin_scripting --&gt; off
          
			Is it the case that httpd_builtin_scripting is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_check_spam_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_check_spam SELinux boolean is disabled:
        $ getsebool httpd_can_check_spam
        If properly configured, the output should show the following:
        httpd_can_check_spam --&gt; off
          
			Is it the case that httpd_can_check_spam is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_connect_ftp_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_connect_ftp SELinux boolean is disabled:
        $ getsebool httpd_can_connect_ftp
        If properly configured, the output should show the following:
        httpd_can_connect_ftp --&gt; off
          
			Is it the case that httpd_can_connect_ftp is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_connect_ldap_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_connect_ldap SELinux boolean is disabled:
        $ getsebool httpd_can_connect_ldap
        If properly configured, the output should show the following:
        httpd_can_connect_ldap --&gt; off
          
			Is it the case that httpd_can_connect_ldap is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_connect_mythtv_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_connect_mythtv SELinux boolean is disabled:
        $ getsebool httpd_can_connect_mythtv
        If properly configured, the output should show the following:
        httpd_can_connect_mythtv --&gt; off
          
			Is it the case that httpd_can_connect_mythtv is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_connect_zabbix_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_connect_zabbix SELinux boolean is disabled:
        $ getsebool httpd_can_connect_zabbix
        If properly configured, the output should show the following:
        httpd_can_connect_zabbix --&gt; off
          
			Is it the case that httpd_can_connect_zabbix is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_network_connect_cobbler_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_network_connect_cobbler SELinux boolean is disabled:
        $ getsebool httpd_can_network_connect_cobbler
        If properly configured, the output should show the following:
        httpd_can_network_connect_cobbler --&gt; off
          
			Is it the case that httpd_can_network_connect_cobbler is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_network_connect_db_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_network_connect_db SELinux boolean is disabled:
        $ getsebool httpd_can_network_connect_db
        If properly configured, the output should show the following:
        httpd_can_network_connect_db --&gt; off
          
			Is it the case that httpd_can_network_connect_db is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_network_connect_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_network_connect SELinux boolean is disabled:
        $ getsebool httpd_can_network_connect
        If properly configured, the output should show the following:
        httpd_can_network_connect --&gt; off
          
			Is it the case that httpd_can_network_connect is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_network_memcache_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_network_memcache SELinux boolean is disabled:
        $ getsebool httpd_can_network_memcache
        If properly configured, the output should show the following:
        httpd_can_network_memcache --&gt; off
          
			Is it the case that httpd_can_network_memcache is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_network_relay_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_network_relay SELinux boolean is disabled:
        $ getsebool httpd_can_network_relay
        If properly configured, the output should show the following:
        httpd_can_network_relay --&gt; off
          
			Is it the case that httpd_can_network_relay is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_can_sendmail_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_can_sendmail SELinux boolean is disabled:
        $ getsebool httpd_can_sendmail
        If properly configured, the output should show the following:
        httpd_can_sendmail --&gt; off
          
			Is it the case that httpd_can_sendmail is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_dbus_avahi_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_dbus_avahi SELinux boolean is disabled:
        $ getsebool httpd_dbus_avahi
        If properly configured, the output should show the following:
        httpd_dbus_avahi --&gt; off
          
			Is it the case that httpd_dbus_avahi is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_dbus_sssd_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_dbus_sssd SELinux boolean is disabled:
        $ getsebool httpd_dbus_sssd
        If properly configured, the output should show the following:
        httpd_dbus_sssd --&gt; off
          
			Is it the case that httpd_dbus_sssd is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_dontaudit_search_dirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_dontaudit_search_dirs SELinux boolean is disabled:
        $ getsebool httpd_dontaudit_search_dirs
        If properly configured, the output should show the following:
        httpd_dontaudit_search_dirs --&gt; off
          
			Is it the case that httpd_dontaudit_search_dirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_enable_cgi_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_enable_cgi SELinux boolean is disabled:
        $ getsebool httpd_enable_cgi
        If properly configured, the output should show the following:
        httpd_enable_cgi --&gt; off
          
			Is it the case that CGI is used with HTTPD or httpd_enable_cgi is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_enable_ftp_server_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_enable_ftp_server SELinux boolean is disabled:
        $ getsebool httpd_enable_ftp_server
        If properly configured, the output should show the following:
        httpd_enable_ftp_server --&gt; off
          
			Is it the case that httpd_enable_ftp_server is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_enable_homedirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_enable_homedirs SELinux boolean is disabled:
        $ getsebool httpd_enable_homedirs
        If properly configured, the output should show the following:
        httpd_enable_homedirs --&gt; off
          
			Is it the case that httpd_enable_homedirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_execmem_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_execmem SELinux boolean is disabled:
        $ getsebool httpd_execmem
        If properly configured, the output should show the following:
        httpd_execmem --&gt; off
          
			Is it the case that httpd_execmem is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_graceful_shutdown_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_graceful_shutdown SELinux boolean is enabled:
        $ getsebool httpd_graceful_shutdown
        If properly configured, the output should show the following:
        httpd_graceful_shutdown --&gt; on
          
			Is it the case that httpd_graceful_shutdown is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_manage_ipa_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_manage_ipa SELinux boolean is disabled:
        $ getsebool httpd_manage_ipa
        If properly configured, the output should show the following:
        httpd_manage_ipa --&gt; off
          
			Is it the case that httpd_manage_ipa is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_mod_auth_ntlm_winbind_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_mod_auth_ntlm_winbind SELinux boolean is disabled:
        $ getsebool httpd_mod_auth_ntlm_winbind
        If properly configured, the output should show the following:
        httpd_mod_auth_ntlm_winbind --&gt; off
          
			Is it the case that httpd_mod_auth_ntlm_winbind is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_mod_auth_pam_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_mod_auth_pam SELinux boolean is disabled:
        $ getsebool httpd_mod_auth_pam
        If properly configured, the output should show the following:
        httpd_mod_auth_pam --&gt; off
          
			Is it the case that httpd_mod_auth_pam is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_read_user_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_read_user_content SELinux boolean is disabled:
        $ getsebool httpd_read_user_content
        If properly configured, the output should show the following:
        httpd_read_user_content --&gt; off
          
			Is it the case that httpd_read_user_content is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_run_ipa_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_run_ipa SELinux boolean is disabled:
        $ getsebool httpd_run_ipa
        If properly configured, the output should show the following:
        httpd_run_ipa --&gt; off
          
			Is it the case that httpd_run_ipa is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_run_preupgrade_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_run_preupgrade SELinux boolean is disabled:
        $ getsebool httpd_run_preupgrade
        If properly configured, the output should show the following:
        httpd_run_preupgrade --&gt; off
          
			Is it the case that httpd_run_preupgrade is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_run_stickshift_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_run_stickshift SELinux boolean is disabled:
        $ getsebool httpd_run_stickshift
        If properly configured, the output should show the following:
        httpd_run_stickshift --&gt; off
          
			Is it the case that httpd_run_stickshift is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_serve_cobbler_files_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_serve_cobbler_files SELinux boolean is disabled:
        $ getsebool httpd_serve_cobbler_files
        If properly configured, the output should show the following:
        httpd_serve_cobbler_files --&gt; off
          
			Is it the case that httpd_serve_cobbler_files is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_setrlimit_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_setrlimit SELinux boolean is disabled:
        $ getsebool httpd_setrlimit
        If properly configured, the output should show the following:
        httpd_setrlimit --&gt; off
          
			Is it the case that httpd_setrlimit is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_ssi_exec_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_ssi_exec SELinux boolean is disabled:
        $ getsebool httpd_ssi_exec
        If properly configured, the output should show the following:
        httpd_ssi_exec --&gt; off
          
			Is it the case that httpd_ssi_exec is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_sys_script_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_sys_script_anon_write SELinux boolean is disabled:
        $ getsebool httpd_sys_script_anon_write
        If properly configured, the output should show the following:
        httpd_sys_script_anon_write --&gt; off
          
			Is it the case that httpd_sys_script_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_tmp_exec_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_tmp_exec SELinux boolean is disabled:
        $ getsebool httpd_tmp_exec
        If properly configured, the output should show the following:
        httpd_tmp_exec --&gt; off
          
			Is it the case that httpd_tmp_exec is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_tty_comm_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_tty_comm SELinux boolean is disabled:
        $ getsebool httpd_tty_comm
        If properly configured, the output should show the following:
        httpd_tty_comm --&gt; off
          
			Is it the case that httpd_tty_comm is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_unified_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_unified SELinux boolean is disabled:
        $ getsebool httpd_unified
        If properly configured, the output should show the following:
        httpd_unified --&gt; off
          
			Is it the case that httpd_unified is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_use_cifs_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_use_cifs SELinux boolean is disabled:
        $ getsebool httpd_use_cifs
        If properly configured, the output should show the following:
        httpd_use_cifs --&gt; off
          
			Is it the case that httpd_use_cifs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_use_fusefs_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_use_fusefs SELinux boolean is disabled:
        $ getsebool httpd_use_fusefs
        If properly configured, the output should show the following:
        httpd_use_fusefs --&gt; off
          
			Is it the case that httpd_use_fusefs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_use_gpg_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_use_gpg SELinux boolean is disabled:
        $ getsebool httpd_use_gpg
        If properly configured, the output should show the following:
        httpd_use_gpg --&gt; off
          
			Is it the case that httpd_use_gpg is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_use_nfs SELinux boolean is disabled:
        $ getsebool httpd_use_nfs
        If properly configured, the output should show the following:
        httpd_use_nfs --&gt; off
          
			Is it the case that httpd_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_use_openstack_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_use_openstack SELinux boolean is disabled:
        $ getsebool httpd_use_openstack
        If properly configured, the output should show the following:
        httpd_use_openstack --&gt; off
          
			Is it the case that httpd_use_openstack is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_use_sasl_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_use_sasl SELinux boolean is disabled:
        $ getsebool httpd_use_sasl
        If properly configured, the output should show the following:
        httpd_use_sasl --&gt; off
          
			Is it the case that httpd_use_sasl is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_httpd_verify_dns_question:question:1">
      <question_text>
            
        Run the following command to determine if the httpd_verify_dns SELinux boolean is disabled:
        $ getsebool httpd_verify_dns
        If properly configured, the output should show the following:
        httpd_verify_dns --&gt; off
          
			Is it the case that httpd_verify_dns is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_icecast_use_any_tcp_ports_question:question:1">
      <question_text>
            
        Run the following command to determine if the icecast_use_any_tcp_ports SELinux boolean is disabled:
        $ getsebool icecast_use_any_tcp_ports
        If properly configured, the output should show the following:
        icecast_use_any_tcp_ports --&gt; off
          
			Is it the case that icecast_use_any_tcp_ports is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_irc_use_any_tcp_ports_question:question:1">
      <question_text>
            
        Run the following command to determine if the irc_use_any_tcp_ports SELinux boolean is disabled:
        $ getsebool irc_use_any_tcp_ports
        If properly configured, the output should show the following:
        irc_use_any_tcp_ports --&gt; off
          
			Is it the case that irc_use_any_tcp_ports is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_irssi_use_full_network_question:question:1">
      <question_text>
            
        Run the following command to determine if the irssi_use_full_network SELinux boolean is disabled:
        $ getsebool irssi_use_full_network
        If properly configured, the output should show the following:
        irssi_use_full_network --&gt; off
          
			Is it the case that irssi_use_full_network is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_kdumpgui_run_bootloader_question:question:1">
      <question_text>
            
        Run the following command to determine if the kdumpgui_run_bootloader SELinux boolean is disabled:
        $ getsebool kdumpgui_run_bootloader
        If properly configured, the output should show the following:
        kdumpgui_run_bootloader --&gt; off
          
			Is it the case that kdumpgui_run_bootloader is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_kerberos_enabled_question:question:1">
      <question_text>
            
        Run the following command to determine if the kerberos_enabled SELinux boolean is enabled:
        $ getsebool kerberos_enabled
        If properly configured, the output should show the following:
        kerberos_enabled --&gt; on
          
			Is it the case that kerberos_enabled is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ksmtuned_use_cifs_question:question:1">
      <question_text>
            
        Run the following command to determine if the ksmtuned_use_cifs SELinux boolean is disabled:
        $ getsebool ksmtuned_use_cifs
        If properly configured, the output should show the following:
        ksmtuned_use_cifs --&gt; off
          
			Is it the case that ksmtuned_use_cifs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ksmtuned_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the ksmtuned_use_nfs SELinux boolean is disabled:
        $ getsebool ksmtuned_use_nfs
        If properly configured, the output should show the following:
        ksmtuned_use_nfs --&gt; off
          
			Is it the case that ksmtuned_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_logadm_exec_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the logadm_exec_content SELinux boolean is enabled:
        $ getsebool logadm_exec_content
        If properly configured, the output should show the following:
        logadm_exec_content --&gt; on
          
			Is it the case that logadm_exec_content is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_logging_syslogd_can_sendmail_question:question:1">
      <question_text>
            
        Run the following command to determine if the logging_syslogd_can_sendmail SELinux boolean is disabled:
        $ getsebool logging_syslogd_can_sendmail
        If properly configured, the output should show the following:
        logging_syslogd_can_sendmail --&gt; off
          
			Is it the case that logging_syslogd_can_sendmail is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_logging_syslogd_run_nagios_plugins_question:question:1">
      <question_text>
            
        Run the following command to determine if the logging_syslogd_run_nagios_plugins SELinux boolean is disabled:
        $ getsebool logging_syslogd_run_nagios_plugins
        If properly configured, the output should show the following:
        logging_syslogd_run_nagios_plugins --&gt; off
          
			Is it the case that logging_syslogd_run_nagios_plugins is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_logging_syslogd_use_tty_question:question:1">
      <question_text>
            
        Run the following command to determine if the logging_syslogd_use_tty SELinux boolean is enabled:
        $ getsebool logging_syslogd_use_tty
        If properly configured, the output should show the following:
        logging_syslogd_use_tty --&gt; on
          
			Is it the case that logging_syslogd_use_tty is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_login_console_enabled_question:question:1">
      <question_text>
            
        Run the following command to determine if the login_console_enabled SELinux boolean is enabled:
        $ getsebool login_console_enabled
        If properly configured, the output should show the following:
        login_console_enabled --&gt; on
          
			Is it the case that login_console_enabled is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_logrotate_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the logrotate_use_nfs SELinux boolean is disabled:
        $ getsebool logrotate_use_nfs
        If properly configured, the output should show the following:
        logrotate_use_nfs --&gt; off
          
			Is it the case that logrotate_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_logwatch_can_network_connect_mail_question:question:1">
      <question_text>
            
        Run the following command to determine if the logwatch_can_network_connect_mail SELinux boolean is disabled:
        $ getsebool logwatch_can_network_connect_mail
        If properly configured, the output should show the following:
        logwatch_can_network_connect_mail --&gt; off
          
			Is it the case that logwatch_can_network_connect_mail is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_lsmd_plugin_connect_any_question:question:1">
      <question_text>
            
        Run the following command to determine if the lsmd_plugin_connect_any SELinux boolean is disabled:
        $ getsebool lsmd_plugin_connect_any
        If properly configured, the output should show the following:
        lsmd_plugin_connect_any --&gt; off
          
			Is it the case that lsmd_plugin_connect_any is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mailman_use_fusefs_question:question:1">
      <question_text>
            
        Run the following command to determine if the mailman_use_fusefs SELinux boolean is disabled:
        $ getsebool mailman_use_fusefs
        If properly configured, the output should show the following:
        mailman_use_fusefs --&gt; off
          
			Is it the case that mailman_use_fusefs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mcelog_client_question:question:1">
      <question_text>
            
        Run the following command to determine if the mcelog_client SELinux boolean is disabled:
        $ getsebool mcelog_client
        If properly configured, the output should show the following:
        mcelog_client --&gt; off
          
			Is it the case that mcelog_client is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mcelog_exec_scripts_question:question:1">
      <question_text>
            
        Run the following command to determine if the mcelog_exec_scripts SELinux boolean is enabled:
        $ getsebool mcelog_exec_scripts
        If properly configured, the output should show the following:
        mcelog_exec_scripts --&gt; on
          
			Is it the case that mcelog_exec_scripts is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mcelog_foreground_question:question:1">
      <question_text>
            
        Run the following command to determine if the mcelog_foreground SELinux boolean is disabled:
        $ getsebool mcelog_foreground
        If properly configured, the output should show the following:
        mcelog_foreground --&gt; off
          
			Is it the case that mcelog_foreground is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mcelog_server_question:question:1">
      <question_text>
            
        Run the following command to determine if the mcelog_server SELinux boolean is disabled:
        $ getsebool mcelog_server
        If properly configured, the output should show the following:
        mcelog_server --&gt; off
          
			Is it the case that mcelog_server is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_minidlna_read_generic_user_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the minidlna_read_generic_user_content SELinux boolean is disabled:
        $ getsebool minidlna_read_generic_user_content
        If properly configured, the output should show the following:
        minidlna_read_generic_user_content --&gt; off
          
			Is it the case that minidlna_read_generic_user_content is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mmap_low_allowed_question:question:1">
      <question_text>
            
        Run the following command to determine if the mmap_low_allowed SELinux boolean is disabled:
        $ getsebool mmap_low_allowed
        If properly configured, the output should show the following:
        mmap_low_allowed --&gt; off
          
			Is it the case that mmap_low_allowed is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mock_enable_homedirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the mock_enable_homedirs SELinux boolean is disabled:
        $ getsebool mock_enable_homedirs
        If properly configured, the output should show the following:
        mock_enable_homedirs --&gt; off
          
			Is it the case that mock_enable_homedirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mount_anyfile_question:question:1">
      <question_text>
            
        Run the following command to determine if the mount_anyfile SELinux boolean is enabled:
        $ getsebool mount_anyfile
        If properly configured, the output should show the following:
        mount_anyfile --&gt; on
          
			Is it the case that mount_anyfile is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mozilla_plugin_bind_unreserved_ports_question:question:1">
      <question_text>
            
        Run the following command to determine if the mozilla_plugin_bind_unreserved_ports SELinux boolean is disabled:
        $ getsebool mozilla_plugin_bind_unreserved_ports
        If properly configured, the output should show the following:
        mozilla_plugin_bind_unreserved_ports --&gt; off
          
			Is it the case that mozilla_plugin_bind_unreserved_ports is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mozilla_plugin_can_network_connect_question:question:1">
      <question_text>
            
        Run the following command to determine if the mozilla_plugin_can_network_connect SELinux boolean is disabled:
        $ getsebool mozilla_plugin_can_network_connect
        If properly configured, the output should show the following:
        mozilla_plugin_can_network_connect --&gt; off
          
			Is it the case that mozilla_plugin_can_network_connect is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mozilla_plugin_use_bluejeans_question:question:1">
      <question_text>
            
        Run the following command to determine if the mozilla_plugin_use_bluejeans SELinux boolean is disabled:
        $ getsebool mozilla_plugin_use_bluejeans
        If properly configured, the output should show the following:
        mozilla_plugin_use_bluejeans --&gt; off
          
			Is it the case that mozilla_plugin_use_bluejeans is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mozilla_plugin_use_gps_question:question:1">
      <question_text>
            
        Run the following command to determine if the mozilla_plugin_use_gps SELinux boolean is disabled:
        $ getsebool mozilla_plugin_use_gps
        If properly configured, the output should show the following:
        mozilla_plugin_use_gps --&gt; off
          
			Is it the case that mozilla_plugin_use_gps is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mozilla_plugin_use_spice_question:question:1">
      <question_text>
            
        Run the following command to determine if the mozilla_plugin_use_spice SELinux boolean is disabled:
        $ getsebool mozilla_plugin_use_spice
        If properly configured, the output should show the following:
        mozilla_plugin_use_spice --&gt; off
          
			Is it the case that mozilla_plugin_use_spice is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mozilla_read_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the mozilla_read_content SELinux boolean is disabled:
        $ getsebool mozilla_read_content
        If properly configured, the output should show the following:
        mozilla_read_content --&gt; off
          
			Is it the case that mozilla_read_content is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mpd_enable_homedirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the mpd_enable_homedirs SELinux boolean is disabled:
        $ getsebool mpd_enable_homedirs
        If properly configured, the output should show the following:
        mpd_enable_homedirs --&gt; off
          
			Is it the case that mpd_enable_homedirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mpd_use_cifs_question:question:1">
      <question_text>
            
        Run the following command to determine if the mpd_use_cifs SELinux boolean is disabled:
        $ getsebool mpd_use_cifs
        If properly configured, the output should show the following:
        mpd_use_cifs --&gt; off
          
			Is it the case that mpd_use_cifs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mpd_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the mpd_use_nfs SELinux boolean is disabled:
        $ getsebool mpd_use_nfs
        If properly configured, the output should show the following:
        mpd_use_nfs --&gt; off
          
			Is it the case that mpd_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mplayer_execstack_question:question:1">
      <question_text>
            
        Run the following command to determine if the mplayer_execstack SELinux boolean is disabled:
        $ getsebool mplayer_execstack
        If properly configured, the output should show the following:
        mplayer_execstack --&gt; off
          
			Is it the case that mplayer_execstack is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_mysql_connect_any_question:question:1">
      <question_text>
            
        Run the following command to determine if the mysql_connect_any SELinux boolean is disabled:
        $ getsebool mysql_connect_any
        If properly configured, the output should show the following:
        mysql_connect_any --&gt; off
          
			Is it the case that mysql_connect_any is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_nagios_run_pnp4nagios_question:question:1">
      <question_text>
            
        Run the following command to determine if the nagios_run_pnp4nagios SELinux boolean is disabled:
        $ getsebool nagios_run_pnp4nagios
        If properly configured, the output should show the following:
        nagios_run_pnp4nagios --&gt; off
          
			Is it the case that nagios_run_pnp4nagios is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_nagios_run_sudo_question:question:1">
      <question_text>
            
        Run the following command to determine if the nagios_run_sudo SELinux boolean is disabled:
        $ getsebool nagios_run_sudo
        If properly configured, the output should show the following:
        nagios_run_sudo --&gt; off
          
			Is it the case that nagios_run_sudo is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_named_tcp_bind_http_port_question:question:1">
      <question_text>
            
        Run the following command to determine if the named_tcp_bind_http_port SELinux boolean is disabled:
        $ getsebool named_tcp_bind_http_port
        If properly configured, the output should show the following:
        named_tcp_bind_http_port --&gt; off
          
			Is it the case that named_tcp_bind_http_port is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_named_write_master_zones_question:question:1">
      <question_text>
            
        Run the following command to determine if the named_write_master_zones SELinux boolean is disabled:
        $ getsebool named_write_master_zones
        If properly configured, the output should show the following:
        named_write_master_zones --&gt; off
          
			Is it the case that named_write_master_zones is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_neutron_can_network_question:question:1">
      <question_text>
            
        Run the following command to determine if the neutron_can_network SELinux boolean is disabled:
        $ getsebool neutron_can_network
        If properly configured, the output should show the following:
        neutron_can_network --&gt; off
          
			Is it the case that neutron_can_network is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_nfsd_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the nfsd_anon_write SELinux boolean is disabled:
        $ getsebool nfsd_anon_write
        If properly configured, the output should show the following:
        nfsd_anon_write --&gt; off
          
			Is it the case that nfsd_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_nfs_export_all_ro_question:question:1">
      <question_text>
            
        Run the following command to determine if the nfs_export_all_ro SELinux boolean is enabled:
        $ getsebool nfs_export_all_ro
        If properly configured, the output should show the following:
        nfs_export_all_ro --&gt; on
          
			Is it the case that nfs_export_all_ro is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_nfs_export_all_rw_question:question:1">
      <question_text>
            
        Run the following command to determine if the nfs_export_all_rw SELinux boolean is enabled:
        $ getsebool nfs_export_all_rw
        If properly configured, the output should show the following:
        nfs_export_all_rw --&gt; on
          
			Is it the case that nfs_export_all_rw is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_nis_enabled_question:question:1">
      <question_text>
            
        Run the following command to determine if the nis_enabled SELinux boolean is disabled:
        $ getsebool nis_enabled
        If properly configured, the output should show the following:
        nis_enabled --&gt; off
          
			Is it the case that nis_enabled is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_nscd_use_shm_question:question:1">
      <question_text>
            
        Run the following command to determine if the nscd_use_shm SELinux boolean is enabled:
        $ getsebool nscd_use_shm
        If properly configured, the output should show the following:
        nscd_use_shm --&gt; on
          
			Is it the case that nscd_use_shm is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_openshift_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the openshift_use_nfs SELinux boolean is disabled:
        $ getsebool openshift_use_nfs
        If properly configured, the output should show the following:
        openshift_use_nfs --&gt; off
          
			Is it the case that openshift_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_openvpn_can_network_connect_question:question:1">
      <question_text>
            
        Run the following command to determine if the openvpn_can_network_connect SELinux boolean is disabled:
        $ getsebool openvpn_can_network_connect
        If properly configured, the output should show the following:
        openvpn_can_network_connect --&gt; off
          
			Is it the case that openvpn_can_network_connect is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_openvpn_enable_homedirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the openvpn_enable_homedirs SELinux boolean is disabled:
        $ getsebool openvpn_enable_homedirs
        If properly configured, the output should show the following:
        openvpn_enable_homedirs --&gt; off
          
			Is it the case that openvpn_enable_homedirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_openvpn_run_unconfined_question:question:1">
      <question_text>
            
        Run the following command to determine if the openvpn_run_unconfined SELinux boolean is disabled:
        $ getsebool openvpn_run_unconfined
        If properly configured, the output should show the following:
        openvpn_run_unconfined --&gt; off
          
			Is it the case that openvpn_run_unconfined is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_pcp_bind_all_unreserved_ports_question:question:1">
      <question_text>
            
        Run the following command to determine if the pcp_bind_all_unreserved_ports SELinux boolean is disabled:
        $ getsebool pcp_bind_all_unreserved_ports
        If properly configured, the output should show the following:
        pcp_bind_all_unreserved_ports --&gt; off
          
			Is it the case that pcp_bind_all_unreserved_ports is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_pcp_read_generic_logs_question:question:1">
      <question_text>
            
        Run the following command to determine if the pcp_read_generic_logs SELinux boolean is disabled:
        $ getsebool pcp_read_generic_logs
        If properly configured, the output should show the following:
        pcp_read_generic_logs --&gt; off
          
			Is it the case that pcp_read_generic_logs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_piranha_lvs_can_network_connect_question:question:1">
      <question_text>
            
        Run the following command to determine if the piranha_lvs_can_network_connect SELinux boolean is disabled:
        $ getsebool piranha_lvs_can_network_connect
        If properly configured, the output should show the following:
        piranha_lvs_can_network_connect --&gt; off
          
			Is it the case that piranha_lvs_can_network_connect is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_polipo_connect_all_unreserved_question:question:1">
      <question_text>
            
        Run the following command to determine if the polipo_connect_all_unreserved SELinux boolean is disabled:
        $ getsebool polipo_connect_all_unreserved
        If properly configured, the output should show the following:
        polipo_connect_all_unreserved --&gt; off
          
			Is it the case that polipo_connect_all_unreserved is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_polipo_session_bind_all_unreserved_ports_question:question:1">
      <question_text>
            
        Run the following command to determine if the polipo_session_bind_all_unreserved_ports SELinux boolean is disabled:
        $ getsebool polipo_session_bind_all_unreserved_ports
        If properly configured, the output should show the following:
        polipo_session_bind_all_unreserved_ports --&gt; off
          
			Is it the case that polipo_session_bind_all_unreserved_ports is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_polipo_session_users_question:question:1">
      <question_text>
            
        Run the following command to determine if the polipo_session_users SELinux boolean is disabled:
        $ getsebool polipo_session_users
        If properly configured, the output should show the following:
        polipo_session_users --&gt; off
          
			Is it the case that polipo_session_users is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_polipo_use_cifs_question:question:1">
      <question_text>
            
        Run the following command to determine if the polipo_use_cifs SELinux boolean is disabled:
        $ getsebool polipo_use_cifs
        If properly configured, the output should show the following:
        polipo_use_cifs --&gt; off
          
			Is it the case that polipo_use_cifs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_polipo_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the polipo_use_nfs SELinux boolean is disabled:
        $ getsebool polipo_use_nfs
        If properly configured, the output should show the following:
        polipo_use_nfs --&gt; off
          
			Is it the case that polipo_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_polyinstantiation_enabled_question:question:1">
      <question_text>
            
        Run the following command to determine if the polyinstantiation_enabled SELinux boolean is disabled:
        $ getsebool polyinstantiation_enabled
        If properly configured, the output should show the following:
        polyinstantiation_enabled --&gt; off
          
			Is it the case that polyinstantiation_enabled is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_postfix_local_write_mail_spool_question:question:1">
      <question_text>
            
        Run the following command to determine if the postfix_local_write_mail_spool SELinux boolean is enabled:
        $ getsebool postfix_local_write_mail_spool
        If properly configured, the output should show the following:
        postfix_local_write_mail_spool --&gt; on
          
			Is it the case that postfix_local_write_mail_spool is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_postgresql_can_rsync_question:question:1">
      <question_text>
            
        Run the following command to determine if the postgresql_can_rsync SELinux boolean is disabled:
        $ getsebool postgresql_can_rsync
        If properly configured, the output should show the following:
        postgresql_can_rsync --&gt; off
          
			Is it the case that postgresql_can_rsync is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_postgresql_selinux_transmit_client_label_question:question:1">
      <question_text>
            
        Run the following command to determine if the postgresql_selinux_transmit_client_label SELinux boolean is disabled:
        $ getsebool postgresql_selinux_transmit_client_label
        If properly configured, the output should show the following:
        postgresql_selinux_transmit_client_label --&gt; off
          
			Is it the case that postgresql_selinux_transmit_client_label is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_postgresql_selinux_unconfined_dbadm_question:question:1">
      <question_text>
            
        Run the following command to determine if the postgresql_selinux_unconfined_dbadm SELinux boolean is enabled:
        $ getsebool postgresql_selinux_unconfined_dbadm
        If properly configured, the output should show the following:
        postgresql_selinux_unconfined_dbadm --&gt; on
          
			Is it the case that postgresql_selinux_unconfined_dbadm is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_postgresql_selinux_users_ddl_question:question:1">
      <question_text>
            
        Run the following command to determine if the postgresql_selinux_users_ddl SELinux boolean is enabled:
        $ getsebool postgresql_selinux_users_ddl
        If properly configured, the output should show the following:
        postgresql_selinux_users_ddl --&gt; on
          
			Is it the case that postgresql_selinux_users_ddl is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_pppd_can_insmod_question:question:1">
      <question_text>
            
        Run the following command to determine if the pppd_can_insmod SELinux boolean is disabled:
        $ getsebool pppd_can_insmod
        If properly configured, the output should show the following:
        pppd_can_insmod --&gt; off
          
			Is it the case that pppd_can_insmod is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_pppd_for_user_question:question:1">
      <question_text>
            
        Run the following command to determine if the pppd_for_user SELinux boolean is disabled:
        $ getsebool pppd_for_user
        If properly configured, the output should show the following:
        pppd_for_user --&gt; off
          
			Is it the case that pppd_for_user is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_privoxy_connect_any_question:question:1">
      <question_text>
            
        Run the following command to determine if the privoxy_connect_any SELinux boolean is disabled:
        $ getsebool privoxy_connect_any
        If properly configured, the output should show the following:
        privoxy_connect_any --&gt; off
          
			Is it the case that privoxy_connect_any is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_prosody_bind_http_port_question:question:1">
      <question_text>
            
        Run the following command to determine if the prosody_bind_http_port SELinux boolean is disabled:
        $ getsebool prosody_bind_http_port
        If properly configured, the output should show the following:
        prosody_bind_http_port --&gt; off
          
			Is it the case that prosody_bind_http_port is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_puppetagent_manage_all_files_question:question:1">
      <question_text>
            
        Run the following command to determine if the puppetagent_manage_all_files SELinux boolean is disabled:
        $ getsebool puppetagent_manage_all_files
        If properly configured, the output should show the following:
        puppetagent_manage_all_files --&gt; off
          
			Is it the case that puppetagent_manage_all_files is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_puppetmaster_use_db_question:question:1">
      <question_text>
            
        Run the following command to determine if the puppetmaster_use_db SELinux boolean is disabled:
        $ getsebool puppetmaster_use_db
        If properly configured, the output should show the following:
        puppetmaster_use_db --&gt; off
          
			Is it the case that puppetmaster_use_db is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_racoon_read_shadow_question:question:1">
      <question_text>
            
        Run the following command to determine if the racoon_read_shadow SELinux boolean is disabled:
        $ getsebool racoon_read_shadow
        If properly configured, the output should show the following:
        racoon_read_shadow --&gt; off
          
			Is it the case that racoon_read_shadow is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_rsync_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the rsync_anon_write SELinux boolean is disabled:
        $ getsebool rsync_anon_write
        If properly configured, the output should show the following:
        rsync_anon_write --&gt; off
          
			Is it the case that rsync_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_rsync_client_question:question:1">
      <question_text>
            
        Run the following command to determine if the rsync_client SELinux boolean is disabled:
        $ getsebool rsync_client
        If properly configured, the output should show the following:
        rsync_client --&gt; off
          
			Is it the case that rsync_client is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_rsync_export_all_ro_question:question:1">
      <question_text>
            
        Run the following command to determine if the rsync_export_all_ro SELinux boolean is disabled:
        $ getsebool rsync_export_all_ro
        If properly configured, the output should show the following:
        rsync_export_all_ro --&gt; off
          
			Is it the case that rsync_export_all_ro is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_rsync_full_access_question:question:1">
      <question_text>
            
        Run the following command to determine if the rsync_full_access SELinux boolean is disabled:
        $ getsebool rsync_full_access
        If properly configured, the output should show the following:
        rsync_full_access --&gt; off
          
			Is it the case that rsync_full_access is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_samba_create_home_dirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the samba_create_home_dirs SELinux boolean is disabled:
        $ getsebool samba_create_home_dirs
        If properly configured, the output should show the following:
        samba_create_home_dirs --&gt; off
          
			Is it the case that samba_create_home_dirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_samba_domain_controller_question:question:1">
      <question_text>
            
        Run the following command to determine if the samba_domain_controller SELinux boolean is disabled:
        $ getsebool samba_domain_controller
        If properly configured, the output should show the following:
        samba_domain_controller --&gt; off
          
			Is it the case that samba_domain_controller is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_samba_enable_home_dirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the samba_enable_home_dirs SELinux boolean is disabled:
        $ getsebool samba_enable_home_dirs
        If properly configured, the output should show the following:
        samba_enable_home_dirs --&gt; off
          
			Is it the case that samba_enable_home_dirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_samba_export_all_ro_question:question:1">
      <question_text>
            
        Run the following command to determine if the samba_export_all_ro SELinux boolean is disabled:
        $ getsebool samba_export_all_ro
        If properly configured, the output should show the following:
        samba_export_all_ro --&gt; off
          
			Is it the case that samba_export_all_ro is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_samba_export_all_rw_question:question:1">
      <question_text>
            
        Run the following command to determine if the samba_export_all_rw SELinux boolean is disabled:
        $ getsebool samba_export_all_rw
        If properly configured, the output should show the following:
        samba_export_all_rw --&gt; off
          
			Is it the case that samba_export_all_rw is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_samba_load_libgfapi_question:question:1">
      <question_text>
            
        Run the following command to determine if the samba_load_libgfapi SELinux boolean is disabled:
        $ getsebool samba_load_libgfapi
        If properly configured, the output should show the following:
        samba_load_libgfapi --&gt; off
          
			Is it the case that samba_load_libgfapi is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_samba_portmapper_question:question:1">
      <question_text>
            
        Run the following command to determine if the samba_portmapper SELinux boolean is disabled:
        $ getsebool samba_portmapper
        If properly configured, the output should show the following:
        samba_portmapper --&gt; off
          
			Is it the case that samba_portmapper is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_samba_run_unconfined_question:question:1">
      <question_text>
            
        Run the following command to determine if the samba_run_unconfined SELinux boolean is disabled:
        $ getsebool samba_run_unconfined
        If properly configured, the output should show the following:
        samba_run_unconfined --&gt; off
          
			Is it the case that samba_run_unconfined is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_samba_share_fusefs_question:question:1">
      <question_text>
            
        Run the following command to determine if the samba_share_fusefs SELinux boolean is disabled:
        $ getsebool samba_share_fusefs
        If properly configured, the output should show the following:
        samba_share_fusefs --&gt; off
          
			Is it the case that samba_share_fusefs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_samba_share_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the samba_share_nfs SELinux boolean is disabled:
        $ getsebool samba_share_nfs
        If properly configured, the output should show the following:
        samba_share_nfs --&gt; off
          
			Is it the case that samba_share_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_sanlock_use_fusefs_question:question:1">
      <question_text>
            
        Run the following command to determine if the sanlock_use_fusefs SELinux boolean is disabled:
        $ getsebool sanlock_use_fusefs
        If properly configured, the output should show the following:
        sanlock_use_fusefs --&gt; off
          
			Is it the case that sanlock_use_fusefs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_sanlock_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the sanlock_use_nfs SELinux boolean is disabled:
        $ getsebool sanlock_use_nfs
        If properly configured, the output should show the following:
        sanlock_use_nfs --&gt; off
          
			Is it the case that sanlock_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_sanlock_use_samba_question:question:1">
      <question_text>
            
        Run the following command to determine if the sanlock_use_samba SELinux boolean is disabled:
        $ getsebool sanlock_use_samba
        If properly configured, the output should show the following:
        sanlock_use_samba --&gt; off
          
			Is it the case that sanlock_use_samba is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_saslauthd_read_shadow_question:question:1">
      <question_text>
            
        Run the following command to determine if the saslauthd_read_shadow SELinux boolean is disabled:
        $ getsebool saslauthd_read_shadow
        If properly configured, the output should show the following:
        saslauthd_read_shadow --&gt; off
          
			Is it the case that saslauthd_read_shadow is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_secadm_exec_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the secadm_exec_content SELinux boolean is enabled:
        $ getsebool secadm_exec_content
        If properly configured, the output should show the following:
        secadm_exec_content --&gt; on
          
			Is it the case that secadm_exec_content is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_secure_mode_insmod_question:question:1">
      <question_text>
            
        Run the following command to determine if the secure_mode_insmod SELinux boolean is disabled:
        $ getsebool secure_mode_insmod
        If properly configured, the output should show the following:
        secure_mode_insmod --&gt; off
          
			Is it the case that secure_mode_insmod is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_secure_mode_question:question:1">
      <question_text>
            
        Run the following command to determine if the secure_mode SELinux boolean is disabled:
        $ getsebool secure_mode
        If properly configured, the output should show the following:
        secure_mode --&gt; off
          
			Is it the case that secure_mode is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_secure_mode_policyload_question:question:1">
      <question_text>
            
        Run the following command to determine if the secure_mode_policyload SELinux boolean is disabled:
        $ getsebool secure_mode_policyload
        If properly configured, the output should show the following:
        secure_mode_policyload --&gt; off
          
			Is it the case that secure_mode_policyload is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_direct_dri_enabled_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_direct_dri_enabled SELinux boolean is disabled:
        $ getsebool selinuxuser_direct_dri_enabled
        If properly configured, the output should show the following:
        selinuxuser_direct_dri_enabled --&gt; off
          
			Is it the case that XWindows is in use or selinuxuser_direct_dri_enabled is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_execheap_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_execheap SELinux boolean is disabled:
        $ getsebool selinuxuser_execheap
        If properly configured, the output should show the following:
        selinuxuser_execheap --&gt; off
          
			Is it the case that selinuxuser_execheap is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_execmod_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_execmod SELinux boolean is enabled:
        $ getsebool selinuxuser_execmod
        If properly configured, the output should show the following:
        selinuxuser_execmod --&gt; on
          
			Is it the case that selinuxuser_execmod is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_execstack_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_execstack SELinux boolean is disabled:
        $ getsebool selinuxuser_execstack
        If properly configured, the output should show the following:
        selinuxuser_execstack --&gt; off
          
			Is it the case that selinuxuser_execstack is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_mysql_connect_enabled_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_mysql_connect_enabled SELinux boolean is disabled:
        $ getsebool selinuxuser_mysql_connect_enabled
        If properly configured, the output should show the following:
        selinuxuser_mysql_connect_enabled --&gt; off
          
			Is it the case that selinuxuser_mysql_connect_enabled is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_ping_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_ping SELinux boolean is enabled:
        $ getsebool selinuxuser_ping
        If properly configured, the output should show the following:
        selinuxuser_ping --&gt; on
          
			Is it the case that selinuxuser_ping is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_postgresql_connect_enabled_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_postgresql_connect_enabled SELinux boolean is disabled:
        $ getsebool selinuxuser_postgresql_connect_enabled
        If properly configured, the output should show the following:
        selinuxuser_postgresql_connect_enabled --&gt; off
          
			Is it the case that selinuxuser_postgresql_connect_enabled is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_rw_noexattrfile_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_rw_noexattrfile SELinux boolean is disabled:
        $ getsebool selinuxuser_rw_noexattrfile
        If properly configured, the output should show the following:
        selinuxuser_rw_noexattrfile --&gt; off
          
			Is it the case that selinuxuser_rw_noexattrfile is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_share_music_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_share_music SELinux boolean is disabled:
        $ getsebool selinuxuser_share_music
        If properly configured, the output should show the following:
        selinuxuser_share_music --&gt; off
          
			Is it the case that selinuxuser_share_music is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_tcp_server_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_tcp_server SELinux boolean is disabled:
        $ getsebool selinuxuser_tcp_server
        If properly configured, the output should show the following:
        selinuxuser_tcp_server --&gt; off
          
			Is it the case that selinuxuser_tcp_server is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_udp_server_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_udp_server SELinux boolean is disabled:
        $ getsebool selinuxuser_udp_server
        If properly configured, the output should show the following:
        selinuxuser_udp_server --&gt; off
          
			Is it the case that selinuxuser_udp_server is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_selinuxuser_use_ssh_chroot_question:question:1">
      <question_text>
            
        Run the following command to determine if the selinuxuser_use_ssh_chroot SELinux boolean is disabled:
        $ getsebool selinuxuser_use_ssh_chroot
        If properly configured, the output should show the following:
        selinuxuser_use_ssh_chroot --&gt; off
          
			Is it the case that selinuxuser_use_ssh_chroot is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_sftpd_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the sftpd_anon_write SELinux boolean is disabled:
        $ getsebool sftpd_anon_write
        If properly configured, the output should show the following:
        sftpd_anon_write --&gt; off
          
			Is it the case that sftpd_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_sftpd_enable_homedirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the sftpd_enable_homedirs SELinux boolean is disabled:
        $ getsebool sftpd_enable_homedirs
        If properly configured, the output should show the following:
        sftpd_enable_homedirs --&gt; off
          
			Is it the case that sftpd_enable_homedirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_sftpd_full_access_question:question:1">
      <question_text>
            
        Run the following command to determine if the sftpd_full_access SELinux boolean is disabled:
        $ getsebool sftpd_full_access
        If properly configured, the output should show the following:
        sftpd_full_access --&gt; off
          
			Is it the case that sftpd_full_access is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_sftpd_write_ssh_home_question:question:1">
      <question_text>
            
        Run the following command to determine if the sftpd_write_ssh_home SELinux boolean is disabled:
        $ getsebool sftpd_write_ssh_home
        If properly configured, the output should show the following:
        sftpd_write_ssh_home --&gt; off
          
			Is it the case that sftpd_write_ssh_home is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_sge_domain_can_network_connect_question:question:1">
      <question_text>
            
        Run the following command to determine if the sge_domain_can_network_connect SELinux boolean is disabled:
        $ getsebool sge_domain_can_network_connect
        If properly configured, the output should show the following:
        sge_domain_can_network_connect --&gt; off
          
			Is it the case that sge_domain_can_network_connect is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_sge_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the sge_use_nfs SELinux boolean is disabled:
        $ getsebool sge_use_nfs
        If properly configured, the output should show the following:
        sge_use_nfs --&gt; off
          
			Is it the case that sge_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_smartmon_3ware_question:question:1">
      <question_text>
            
        Run the following command to determine if the smartmon_3ware SELinux boolean is disabled:
        $ getsebool smartmon_3ware
        If properly configured, the output should show the following:
        smartmon_3ware --&gt; off
          
			Is it the case that smartmon_3ware is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_smbd_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the smbd_anon_write SELinux boolean is disabled:
        $ getsebool smbd_anon_write
        If properly configured, the output should show the following:
        smbd_anon_write --&gt; off
          
			Is it the case that smbd_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_spamassassin_can_network_question:question:1">
      <question_text>
            
        Run the following command to determine if the spamassassin_can_network SELinux boolean is disabled:
        $ getsebool spamassassin_can_network
        If properly configured, the output should show the following:
        spamassassin_can_network --&gt; off
          
			Is it the case that spamassassin_can_network is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_spamd_enable_home_dirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the spamd_enable_home_dirs SELinux boolean is enabled:
        $ getsebool spamd_enable_home_dirs
        If properly configured, the output should show the following:
        spamd_enable_home_dirs --&gt; on
          
			Is it the case that spamd_enable_home_dirs is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_squid_connect_any_question:question:1">
      <question_text>
            
        Run the following command to determine if the squid_connect_any SELinux boolean is disabled:
        $ getsebool squid_connect_any
        If properly configured, the output should show the following:
        squid_connect_any --&gt; off
          
			Is it the case that squid_connect_any is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_squid_use_tproxy_question:question:1">
      <question_text>
            
        Run the following command to determine if the squid_use_tproxy SELinux boolean is disabled:
        $ getsebool squid_use_tproxy
        If properly configured, the output should show the following:
        squid_use_tproxy --&gt; off
          
			Is it the case that squid_use_tproxy is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ssh_chroot_rw_homedirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the ssh_chroot_rw_homedirs SELinux boolean is disabled:
        $ getsebool ssh_chroot_rw_homedirs
        If properly configured, the output should show the following:
        ssh_chroot_rw_homedirs --&gt; off
          
			Is it the case that ssh_chroot_rw_homedirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ssh_keysign_question:question:1">
      <question_text>
            
        Run the following command to determine if the ssh_keysign SELinux boolean is disabled:
        $ getsebool ssh_keysign
        If properly configured, the output should show the following:
        ssh_keysign --&gt; off
          
			Is it the case that ssh_keysign is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_ssh_sysadm_login_question:question:1">
      <question_text>
            
        Run the following command to determine if the ssh_sysadm_login SELinux boolean is disabled:
        $ getsebool ssh_sysadm_login
        If properly configured, the output should show the following:
        ssh_sysadm_login --&gt; off
          
			Is it the case that ssh_sysadm_login is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_staff_exec_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the staff_exec_content SELinux boolean is enabled:
        $ getsebool staff_exec_content
        If properly configured, the output should show the following:
        staff_exec_content --&gt; on
          
			Is it the case that staff_exec_content is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_staff_use_svirt_question:question:1">
      <question_text>
            
        Run the following command to determine if the staff_use_svirt SELinux boolean is disabled:
        $ getsebool staff_use_svirt
        If properly configured, the output should show the following:
        staff_use_svirt --&gt; off
          
			Is it the case that staff_use_svirt is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_swift_can_network_question:question:1">
      <question_text>
            
        Run the following command to determine if the swift_can_network SELinux boolean is disabled:
        $ getsebool swift_can_network
        If properly configured, the output should show the following:
        swift_can_network --&gt; off
          
			Is it the case that swift_can_network is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_sysadm_exec_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the sysadm_exec_content SELinux boolean is enabled:
        $ getsebool sysadm_exec_content
        If properly configured, the output should show the following:
        sysadm_exec_content --&gt; on
          
			Is it the case that sysadm_exec_content is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_telepathy_connect_all_ports_question:question:1">
      <question_text>
            
        Run the following command to determine if the telepathy_connect_all_ports SELinux boolean is disabled:
        $ getsebool telepathy_connect_all_ports
        If properly configured, the output should show the following:
        telepathy_connect_all_ports --&gt; off
          
			Is it the case that telepathy_connect_all_ports is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_telepathy_tcp_connect_generic_network_ports_question:question:1">
      <question_text>
            
        Run the following command to determine if the telepathy_tcp_connect_generic_network_ports SELinux boolean is disabled:
        $ getsebool telepathy_tcp_connect_generic_network_ports
        If properly configured, the output should show the following:
        telepathy_tcp_connect_generic_network_ports --&gt; off
          
			Is it the case that telepathy_tcp_connect_generic_network_ports is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_tftp_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the tftp_anon_write SELinux boolean is disabled:
        $ getsebool tftp_anon_write
        If properly configured, the output should show the following:
        tftp_anon_write --&gt; off
          
			Is it the case that tftp_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_tftp_home_dir_question:question:1">
      <question_text>
            
        Run the following command to determine if the tftp_home_dir SELinux boolean is disabled:
        $ getsebool tftp_home_dir
        If properly configured, the output should show the following:
        tftp_home_dir --&gt; off
          
			Is it the case that tftp_home_dir is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_tmpreaper_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the tmpreaper_use_nfs SELinux boolean is disabled:
        $ getsebool tmpreaper_use_nfs
        If properly configured, the output should show the following:
        tmpreaper_use_nfs --&gt; off
          
			Is it the case that tmpreaper_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_tmpreaper_use_samba_question:question:1">
      <question_text>
            
        Run the following command to determine if the tmpreaper_use_samba SELinux boolean is disabled:
        $ getsebool tmpreaper_use_samba
        If properly configured, the output should show the following:
        tmpreaper_use_samba --&gt; off
          
			Is it the case that tmpreaper_use_samba is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_tor_bind_all_unreserved_ports_question:question:1">
      <question_text>
            
        Run the following command to determine if the tor_bind_all_unreserved_ports SELinux boolean is disabled:
        $ getsebool tor_bind_all_unreserved_ports
        If properly configured, the output should show the following:
        tor_bind_all_unreserved_ports --&gt; off
          
			Is it the case that tor_bind_all_unreserved_ports is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_tor_can_network_relay_question:question:1">
      <question_text>
            
        Run the following command to determine if the tor_can_network_relay SELinux boolean is disabled:
        $ getsebool tor_can_network_relay
        If properly configured, the output should show the following:
        tor_can_network_relay --&gt; off
          
			Is it the case that tor_can_network_relay is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_unconfined_chrome_sandbox_transition_question:question:1">
      <question_text>
            
        Run the following command to determine if the unconfined_chrome_sandbox_transition SELinux boolean is enabled:
        $ getsebool unconfined_chrome_sandbox_transition
        If properly configured, the output should show the following:
        unconfined_chrome_sandbox_transition --&gt; on
          
			Is it the case that unconfined_chrome_sandbox_transition is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_unconfined_login_question:question:1">
      <question_text>
            
        Run the following command to determine if the unconfined_login SELinux boolean is enabled:
        $ getsebool unconfined_login
        If properly configured, the output should show the following:
        unconfined_login --&gt; on
          
			Is it the case that unconfined_login is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_unconfined_mozilla_plugin_transition_question:question:1">
      <question_text>
            
        Run the following command to determine if the unconfined_mozilla_plugin_transition SELinux boolean is enabled:
        $ getsebool unconfined_mozilla_plugin_transition
        If properly configured, the output should show the following:
        unconfined_mozilla_plugin_transition --&gt; on
          
			Is it the case that unconfined_mozilla_plugin_transition is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_unprivuser_use_svirt_question:question:1">
      <question_text>
            
        Run the following command to determine if the unprivuser_use_svirt SELinux boolean is disabled:
        $ getsebool unprivuser_use_svirt
        If properly configured, the output should show the following:
        unprivuser_use_svirt --&gt; off
          
			Is it the case that unprivuser_use_svirt is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_use_ecryptfs_home_dirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the use_ecryptfs_home_dirs SELinux boolean is disabled:
        $ getsebool use_ecryptfs_home_dirs
        If properly configured, the output should show the following:
        use_ecryptfs_home_dirs --&gt; off
          
			Is it the case that use_ecryptfs_home_dirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_use_fusefs_home_dirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the use_fusefs_home_dirs SELinux boolean is disabled:
        $ getsebool use_fusefs_home_dirs
        If properly configured, the output should show the following:
        use_fusefs_home_dirs --&gt; off
          
			Is it the case that use_fusefs_home_dirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_use_lpd_server_question:question:1">
      <question_text>
            
        Run the following command to determine if the use_lpd_server SELinux boolean is disabled:
        $ getsebool use_lpd_server
        If properly configured, the output should show the following:
        use_lpd_server --&gt; off
          
			Is it the case that use_lpd_server is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_use_nfs_home_dirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the use_nfs_home_dirs SELinux boolean is disabled:
        $ getsebool use_nfs_home_dirs
        If properly configured, the output should show the following:
        use_nfs_home_dirs --&gt; off
          
			Is it the case that use_nfs_home_dirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_user_exec_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the user_exec_content SELinux boolean is enabled:
        $ getsebool user_exec_content
        If properly configured, the output should show the following:
        user_exec_content --&gt; on
          
			Is it the case that user_exec_content is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_use_samba_home_dirs_question:question:1">
      <question_text>
            
        Run the following command to determine if the use_samba_home_dirs SELinux boolean is disabled:
        $ getsebool use_samba_home_dirs
        If properly configured, the output should show the following:
        use_samba_home_dirs --&gt; off
          
			Is it the case that use_samba_home_dirs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_varnishd_connect_any_question:question:1">
      <question_text>
            
        Run the following command to determine if the varnishd_connect_any SELinux boolean is disabled:
        $ getsebool varnishd_connect_any
        If properly configured, the output should show the following:
        varnishd_connect_any --&gt; off
          
			Is it the case that varnishd_connect_any is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_read_qemu_ga_data_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_read_qemu_ga_data SELinux boolean is disabled:
        $ getsebool virt_read_qemu_ga_data
        If properly configured, the output should show the following:
        virt_read_qemu_ga_data --&gt; off
          
			Is it the case that virt_read_qemu_ga_data is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_rw_qemu_ga_data_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_rw_qemu_ga_data SELinux boolean is disabled:
        $ getsebool virt_rw_qemu_ga_data
        If properly configured, the output should show the following:
        virt_rw_qemu_ga_data --&gt; off
          
			Is it the case that virt_rw_qemu_ga_data is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_sandbox_use_all_caps_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_sandbox_use_all_caps SELinux boolean is disabled:
        $ getsebool virt_sandbox_use_all_caps
        If properly configured, the output should show the following:
        virt_sandbox_use_all_caps --&gt; off
          
			Is it the case that virt_sandbox_use_all_caps is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_sandbox_use_audit_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_sandbox_use_audit SELinux boolean is enabled:
        $ getsebool virt_sandbox_use_audit
        If properly configured, the output should show the following:
        virt_sandbox_use_audit --&gt; on
          
			Is it the case that virt_sandbox_use_audit is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_sandbox_use_mknod_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_sandbox_use_mknod SELinux boolean is disabled:
        $ getsebool virt_sandbox_use_mknod
        If properly configured, the output should show the following:
        virt_sandbox_use_mknod --&gt; off
          
			Is it the case that virt_sandbox_use_mknod is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_sandbox_use_netlink_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_sandbox_use_netlink SELinux boolean is disabled:
        $ getsebool virt_sandbox_use_netlink
        If properly configured, the output should show the following:
        virt_sandbox_use_netlink --&gt; off
          
			Is it the case that virt_sandbox_use_netlink is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_sandbox_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_sandbox_use_nfs SELinux boolean is disabled:
        $ getsebool virt_sandbox_use_nfs
        If properly configured, the output should show the following:
        virt_sandbox_use_nfs --&gt; off
          
			Is it the case that virt_sandbox_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_sandbox_use_samba_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_sandbox_use_samba SELinux boolean is disabled:
        $ getsebool virt_sandbox_use_samba
        If properly configured, the output should show the following:
        virt_sandbox_use_samba --&gt; off
          
			Is it the case that virt_sandbox_use_samba is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_sandbox_use_sys_admin_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_sandbox_use_sys_admin SELinux boolean is disabled:
        $ getsebool virt_sandbox_use_sys_admin
        If properly configured, the output should show the following:
        virt_sandbox_use_sys_admin --&gt; off
          
			Is it the case that virt_sandbox_use_sys_admin is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_transition_userdomain_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_transition_userdomain SELinux boolean is disabled:
        $ getsebool virt_transition_userdomain
        If properly configured, the output should show the following:
        virt_transition_userdomain --&gt; off
          
			Is it the case that virt_transition_userdomain is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_use_comm_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_use_comm SELinux boolean is disabled:
        $ getsebool virt_use_comm
        If properly configured, the output should show the following:
        virt_use_comm --&gt; off
          
			Is it the case that virt_use_comm is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_use_execmem_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_use_execmem SELinux boolean is disabled:
        $ getsebool virt_use_execmem
        If properly configured, the output should show the following:
        virt_use_execmem --&gt; off
          
			Is it the case that virt_use_execmem is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_use_fusefs_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_use_fusefs SELinux boolean is disabled:
        $ getsebool virt_use_fusefs
        If properly configured, the output should show the following:
        virt_use_fusefs --&gt; off
          
			Is it the case that virt_use_fusefs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_use_nfs SELinux boolean is disabled:
        $ getsebool virt_use_nfs
        If properly configured, the output should show the following:
        virt_use_nfs --&gt; off
          
			Is it the case that virt_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_use_rawip_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_use_rawip SELinux boolean is disabled:
        $ getsebool virt_use_rawip
        If properly configured, the output should show the following:
        virt_use_rawip --&gt; off
          
			Is it the case that virt_use_rawip is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_use_samba_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_use_samba SELinux boolean is disabled:
        $ getsebool virt_use_samba
        If properly configured, the output should show the following:
        virt_use_samba --&gt; off
          
			Is it the case that virt_use_samba is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_use_sanlock_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_use_sanlock SELinux boolean is disabled:
        $ getsebool virt_use_sanlock
        If properly configured, the output should show the following:
        virt_use_sanlock --&gt; off
          
			Is it the case that virt_use_sanlock is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_use_usb_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_use_usb SELinux boolean is disabled:
        $ getsebool virt_use_usb
        If properly configured, the output should show the following:
        virt_use_usb --&gt; off
          
			Is it the case that virt_use_usb is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_virt_use_xserver_question:question:1">
      <question_text>
            
        Run the following command to determine if the virt_use_xserver SELinux boolean is disabled:
        $ getsebool virt_use_xserver
        If properly configured, the output should show the following:
        virt_use_xserver --&gt; off
          
			Is it the case that virt_use_xserver is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_webadm_manage_user_files_question:question:1">
      <question_text>
            
        Run the following command to determine if the webadm_manage_user_files SELinux boolean is disabled:
        $ getsebool webadm_manage_user_files
        If properly configured, the output should show the following:
        webadm_manage_user_files --&gt; off
          
			Is it the case that webadm_manage_user_files is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_webadm_read_user_files_question:question:1">
      <question_text>
            
        Run the following command to determine if the webadm_read_user_files SELinux boolean is disabled:
        $ getsebool webadm_read_user_files
        If properly configured, the output should show the following:
        webadm_read_user_files --&gt; off
          
			Is it the case that webadm_read_user_files is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_wine_mmap_zero_ignore_question:question:1">
      <question_text>
            
        Run the following command to determine if the wine_mmap_zero_ignore SELinux boolean is disabled:
        $ getsebool wine_mmap_zero_ignore
        If properly configured, the output should show the following:
        wine_mmap_zero_ignore --&gt; off
          
			Is it the case that wine_mmap_zero_ignore is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xdm_bind_vnc_tcp_port_question:question:1">
      <question_text>
            
        Run the following command to determine if the xdm_bind_vnc_tcp_port SELinux boolean is disabled:
        $ getsebool xdm_bind_vnc_tcp_port
        If properly configured, the output should show the following:
        xdm_bind_vnc_tcp_port --&gt; off
          
			Is it the case that xdm_bind_vnc_tcp_port is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xdm_exec_bootloader_question:question:1">
      <question_text>
            
        Run the following command to determine if the xdm_exec_bootloader SELinux boolean is disabled:
        $ getsebool xdm_exec_bootloader
        If properly configured, the output should show the following:
        xdm_exec_bootloader --&gt; off
          
			Is it the case that xdm_exec_bootloader is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xdm_sysadm_login_question:question:1">
      <question_text>
            
        Run the following command to determine if the xdm_sysadm_login SELinux boolean is disabled:
        $ getsebool xdm_sysadm_login
        If properly configured, the output should show the following:
        xdm_sysadm_login --&gt; off
          
			Is it the case that xdm_sysadm_login is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xdm_write_home_question:question:1">
      <question_text>
            
        Run the following command to determine if the xdm_write_home SELinux boolean is disabled:
        $ getsebool xdm_write_home
        If properly configured, the output should show the following:
        xdm_write_home --&gt; off
          
			Is it the case that xdm_write_home is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xend_run_blktap_question:question:1">
      <question_text>
            
        Run the following command to determine if the xend_run_blktap SELinux boolean is enabled:
        $ getsebool xend_run_blktap
        If properly configured, the output should show the following:
        xend_run_blktap --&gt; on
          
			Is it the case that xend_run_blktap is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xend_run_qemu_question:question:1">
      <question_text>
            
        Run the following command to determine if the xend_run_qemu SELinux boolean is enabled:
        $ getsebool xend_run_qemu
        If properly configured, the output should show the following:
        xend_run_qemu --&gt; on
          
			Is it the case that xend_run_qemu is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xen_use_nfs_question:question:1">
      <question_text>
            
        Run the following command to determine if the xen_use_nfs SELinux boolean is disabled:
        $ getsebool xen_use_nfs
        If properly configured, the output should show the following:
        xen_use_nfs --&gt; off
          
			Is it the case that xen_use_nfs is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xguest_connect_network_question:question:1">
      <question_text>
            
        Run the following command to determine if the xguest_connect_network SELinux boolean is disabled:
        $ getsebool xguest_connect_network
        If properly configured, the output should show the following:
        xguest_connect_network --&gt; off
          
			Is it the case that xguest_connect_network is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xguest_exec_content_question:question:1">
      <question_text>
            
        Run the following command to determine if the xguest_exec_content SELinux boolean is disabled:
        $ getsebool xguest_exec_content
        If properly configured, the output should show the following:
        xguest_exec_content --&gt; off
          
			Is it the case that xguest_exec_content is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xguest_mount_media_question:question:1">
      <question_text>
            
        Run the following command to determine if the xguest_mount_media SELinux boolean is disabled:
        $ getsebool xguest_mount_media
        If properly configured, the output should show the following:
        xguest_mount_media --&gt; off
          
			Is it the case that xguest_mount_media is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xguest_use_bluetooth_question:question:1">
      <question_text>
            
        Run the following command to determine if the xguest_use_bluetooth SELinux boolean is disabled:
        $ getsebool xguest_use_bluetooth
        If properly configured, the output should show the following:
        xguest_use_bluetooth --&gt; off
          
			Is it the case that xguest_use_bluetooth is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xserver_clients_write_xshm_question:question:1">
      <question_text>
            
        Run the following command to determine if the xserver_clients_write_xshm SELinux boolean is disabled:
        $ getsebool xserver_clients_write_xshm
        If properly configured, the output should show the following:
        xserver_clients_write_xshm --&gt; off
          
			Is it the case that xserver_clients_write_xshm is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xserver_execmem_question:question:1">
      <question_text>
            
        Run the following command to determine if the xserver_execmem SELinux boolean is disabled:
        $ getsebool xserver_execmem
        If properly configured, the output should show the following:
        xserver_execmem --&gt; off
          
			Is it the case that xserver_execmem is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_xserver_object_manager_question:question:1">
      <question_text>
            
        Run the following command to determine if the xserver_object_manager SELinux boolean is disabled:
        $ getsebool xserver_object_manager
        If properly configured, the output should show the following:
        xserver_object_manager --&gt; off
          
			Is it the case that xserver_object_manager is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_zabbix_can_network_question:question:1">
      <question_text>
            
        Run the following command to determine if the zabbix_can_network SELinux boolean is disabled:
        $ getsebool zabbix_can_network
        If properly configured, the output should show the following:
        zabbix_can_network --&gt; off
          
			Is it the case that zabbix_can_network is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_zarafa_setrlimit_question:question:1">
      <question_text>
            
        Run the following command to determine if the zarafa_setrlimit SELinux boolean is disabled:
        $ getsebool zarafa_setrlimit
        If properly configured, the output should show the following:
        zarafa_setrlimit --&gt; off
          
			Is it the case that zarafa_setrlimit is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_zebra_write_config_question:question:1">
      <question_text>
            
        Run the following command to determine if the zebra_write_config SELinux boolean is disabled:
        $ getsebool zebra_write_config
        If properly configured, the output should show the following:
        zebra_write_config --&gt; off
          
			Is it the case that zebra_write_config is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_zoneminder_anon_write_question:question:1">
      <question_text>
            
        Run the following command to determine if the zoneminder_anon_write SELinux boolean is disabled:
        $ getsebool zoneminder_anon_write
        If properly configured, the output should show the following:
        zoneminder_anon_write --&gt; off
          
			Is it the case that zoneminder_anon_write is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sebool_zoneminder_run_sudo_question:question:1">
      <question_text>
            
        Run the following command to determine if the zoneminder_run_sudo SELinux boolean is disabled:
        $ getsebool zoneminder_run_sudo
        If properly configured, the output should show the following:
        zoneminder_run_sudo --&gt; off
          
			Is it the case that zoneminder_run_sudo is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-no_direct_root_logins_question:question:1">
      <question_text>
To ensure root may not directly login to the system over physical consoles,
run the following command:
cat /etc/securetty
If any output is returned, this is a finding.

			Is it the case that the /etc/securetty file is not empty?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-securetty_root_login_console_only_question:question:1">
      <question_text>
To check for virtual console entries which permit root login, run the
following command:
$ sudo grep ^vc/[0-9] /etc/securetty
If any output is returned, then root logins over virtual console devices is permitted.

			Is it the case that root login over virtual console devices is permitted?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-restrict_serial_port_logins_question:question:1">
      <question_text>
To check for serial port entries which permit root login,
run the following command:
$ sudo grep ^ttyS/[0-9] /etc/securetty
If any output is returned, then root login over serial ports is permitted.

			Is it the case that root login over serial ports is permitted?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-no_root_webbrowsing_question:question:1">
      <question_text>
Check the root home directory for a .mozilla directory. If
one exists, ensure browsing is limited to local service administration.

			Is it the case that this is not the case?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-no_shelllogin_for_systemaccounts_question:question:1">
      <question_text>
To obtain a listing of all users, their UIDs, and their shells, run the
command: $ awk -F: '{print $1 ":" $3 ":" $7}' /etc/passwd Identify
the system accounts from this listing. These will primarily be the accounts
with UID numbers less than UID_MIN, other than root. Value of the UID_MIN
directive is set in /etc/login.defs configuration file. In the default
configuration UID_MIN is set to 1000.

			Is it the case that any system account (other than root) has a login shell?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_no_uid_except_zero_question:question:1">
      <question_text>
To list all password file entries for accounts with UID 0, run the following command:
$ awk -F: '($3 == "0") {print}' /etc/passwd
This should print only one line, for the user root.

If there is a finding, change the UID of the failing (non-root) user. If the account is
associated with the system commands or applications the UID should be changed to one 
greater than 0 but less than 1000. Otherwise assign a UID of
greater than 1000 that has not already been assigned.

			Is it the case that any account other than root has a UID of 0?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-root_path_default_question:question:1">
      <question_text>
To view the root user's PATH, run the following command:
$ sudo env | grep PATH
If correctly configured, the PATH must: use vendor default settings,
have no empty entries, and have no entries beginning with a character
other than a slash (/).

			Is it the case that any of these conditions are not met?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-no_empty_passwords_question:question:1">
      <question_text>
To verify that null passwords cannot be used, run the following command:
$ grep nullok /etc/pam.d/system-auth
If this produces any output, it may be possible to log into accounts
with empty passwords. Remove any instances of the nullok option to
prevent logins with empty passwords.

			Is it the case that NULL passwords can be used?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_all_shadowed_question:question:1">
      <question_text>
To check that no password hashes are stored in
/etc/passwd, run the following command:
$ awk -F: '($2 != "x") {print}' /etc/passwd
If it produces any output, then a password hash is
stored in /etc/passwd.

			Is it the case that any stored hashes are found in /etc/passwd?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-gid_passwd_group_same_question:question:1">
      <question_text>
To ensure all GIDs referenced in /etc/passwd are defined in /etc/group,
run the following command:
$ sudo pwck -qr
There should be no output.

			Is it the case that GIFs referenced in /etc/passwd are returned as not defined in /etc/group?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-no_netrc_files_question:question:1">
      <question_text>
To check the system for the existence of any .netrc files,
run the following command:
$ sudo find /home -xdev -name .netrc


			Is it the case that any .netrc files exist?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_minlen_login_defs_question:question:1">
      <question_text>
To check the minimum password length, run the command:
$ grep PASS_MIN_LEN /etc/login.defs
The DoD requirement is 15. 

			Is it the case that it is not set to the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_minimum_age_login_defs_question:question:1">
      <question_text>
To check the minimum password age, run the command:
$ grep PASS_MIN_DAYS /etc/login.defs

			Is it the case that it is not equal to or greater than the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_maximum_age_login_defs_question:question:1">
      <question_text>
To check the maximum password age, run the command:
$ grep PASS_MAX_DAYS /etc/login.defs
The DoD and FISMA requirement is 60.
A value of 180 days is sufficient for many environments. 

			Is it the case that PASS_MAX_DAYS is not set equal to or greater than the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_warn_age_login_defs_question:question:1">
      <question_text>
To check the password warning age, run the command:
$ grep PASS_WARN_AGE /etc/login.defs
The DoD requirement is 7.

			Is it the case that it is not set to the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-account_disable_post_pw_expiration_question:question:1">
      <question_text>
To verify the INACTIVE setting, run the following command:
$ grep "INACTIVE" /etc/default/useradd
The output should indicate the INACTIVE configuration option is set
to an appropriate integer as shown in the example below:
$ sudo grep "INACTIVE" /etc/default/useradd
INACTIVE=
			Is it the case that the value of INACTIVE is greater than the expected value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-account_unique_name_question:question:1">
      <question_text>
Run the following command to check for duplicate account names:
$ sudo pwck -qr
If there are no duplicate names, no line will be returned.

			Is it the case that a line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-account_temp_expire_date_question:question:1">
      <question_text>
For every temporary and emergency account, run the following command
to obtain its account aging and expiration information:
$ sudo chage -l USER
Verify each of these accounts has an expiration date set as documented.

			Is it the case that any temporary or emergency accounts have no expiration date set or do not expire within a documented time frame?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-display_login_attempts_question:question:1">
      <question_text>
To ensure that last logon/access notification is configured correctly, run
the following command:
$ grep pam_lastlog.so /etc/pam.d/postlogin
The output should show output showfailed.

			Is it the case that that is not the case?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_retry_question:question:1">
      <question_text>
To check how many retry attempts are permitted on a per-session basis, run the following command:
$ grep pam_pwquality /etc/pam.d/system-auth
The retry parameter will indicate how many attempts are permitted.
The DoD required value is less than or equal to 3.
This would appear as retry=3, or a lower value.

			Is it the case that it is not the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_maxrepeat_question:question:1">
      <question_text>
To check the maximum value for consecutive repeating characters, run the following command:
$ grep maxrepeat /etc/security/pwquality.conf
Look for the value of the maxrepeat parameter. The DoD requirement is 2, which would appear as
maxrepeat=2.

			Is it the case that maxrepeat is not found or not greater than or equal to the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_maxclassrepeat_question:question:1">
      <question_text>
To check the value for maximum consecutive repeating characters, run the following command:
$ grep maxclassrepeat /etc/security/pwquality.conf
For DoD systems, the output should show maxclassrepeat=4.

			Is it the case that that is not the case?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_dcredit_question:question:1">
      <question_text>
To check how many digits are required in a password, run the following command:
$ grep dcredit /etc/security/pwquality.conf
The dcredit parameter (as a negative number) will indicate how many digits are required.
The DoD requires at least one digit in a password. This would appear as dcredit = -1.

			Is it the case that dcredit is not found or not equal to or less than the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_minlen_question:question:1">
      <question_text>
To check how many characters are required in a password, run the following command:
$ grep minlen /etc/security/pwquality.conf
Your output should contain minlen = 

			Is it the case that minlen is not found, or not equal to or greater than the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_ucredit_question:question:1">
      <question_text>
To check how many uppercase characters are required in a password, run the following command:
$ grep ucredit /etc/security/pwquality.conf
The ucredit parameter (as a negative number) will indicate how many uppercase characters are required.
The DoD and FISMA require at least one uppercase character in a password.
This would appear as ucredit = -1.

			Is it the case that ucredit is not found or not set less than or equal to the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_ocredit_question:question:1">
      <question_text>
To check how many special characters are required in a password, run the following command:
$ grep ocredit /etc/security/pwquality.conf
The ocredit parameter (as a negative number) will indicate how many special characters are required.
The DoD and FISMA require at least one special character in a password.
This would appear as ocredit = -1.

			Is it the case that ocredit is not found or not equal to or less than the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_lcredit_question:question:1">
      <question_text>
To check how many lowercase characters are required in a password, run the following command:
$ grep lcredit /etc/security/pwquality.conf
The lcredit parameter (as a negative number) will indicate how many special characters are required.
The DoD and FISMA require at least one lowercase character in a password. This would appear as lcredit = -1.

			Is it the case that lcredit is not found or not less than or equal to the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_difok_question:question:1">
      <question_text>
To check how many characters must differ during a password change, run the following command:
$ grep difok /etc/security/pwquality.conf
The difok parameter will indicate how many characters must differ. 

			Is it the case that difok is not found or not equal to or greater than the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_minclass_question:question:1">
      <question_text>
To check how many categories of characters must be used in password during a password change,
run the following command:
$ grep minclass /etc/security/pwquality.conf
The minclass parameter will indicate how many character classes must be used. If
the requirement was for the password to contain characters from three different categories,
then this would appear as minclass = 3.

			Is it the case that minclass is not found or not set equal to or greater than the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_deny_question:question:1">
      <question_text>
To ensure the failed password attempt policy is configured correctly, run the following command:
$ grep pam_faillock /etc/pam.d/system-auth
The output should show deny=.

			Is it the case that that is not the case?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_unlock_time_question:question:1">
      <question_text>
To ensure the failed password attempt policy is configured correctly, run the following command:
$ grep pam_faillock /etc/pam.d/system-auth
The output should show unlock_time=&lt;some-large-number&gt;.

			Is it the case that unlock_time is less than the expected value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_deny_root_question:question:1">
      <question_text>
To ensure that even the root account is locked after a defined number of failed password
attempts, run the following command:
$ grep even_deny_root /etc/pam.d/system-auth
The output should show even_deny_root.

			Is it the case that that is not the case?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_passwords_pam_faillock_interval_question:question:1">
      <question_text>
To ensure the failed password attempt policy is configured correctly, run the following command:
$ grep pam_faillock /etc/pam.d/system-auth /etc/pam.d/password-auth
For each file, the output should show fail_interval=&lt;interval-in-seconds&gt; where interval-in-seconds is 
  or greater. 
If the fail_interval parameter is not set, the default setting of 900 seconds is acceptable.

			Is it the case that fail_interval is less than the required value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_password_pam_unix_remember_question:question:1">
      <question_text>
To verify the password reuse setting is compliant, run the following command:
$ grep remember /etc/pam.d/system-auth
The output should show the following at the end of the line:
remember=

			Is it the case that the value of remember is not set equal to or greater than the expected setting?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-set_password_hashing_algorithm_systemauth_question:question:1">
      <question_text>
Inspect the password section of /etc/pam.d/system-auth and
ensure that the pam_unix.so module includes the argument
sha512:
$ grep sha512 /etc/pam.d/system-auth

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-set_password_hashing_algorithm_logindefs_question:question:1">
      <question_text>
Inspect /etc/login.defs and ensure the following line appears:
ENCRYPT_METHOD SHA512

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-set_password_hashing_algorithm_libuserconf_question:question:1">
      <question_text>
Inspect /etc/libuser.conf and ensure the following line appears
in the [default] section:
crypt_style = sha512

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_tmout_question:question:1">
      <question_text>
Run the following command to ensure the TMOUT value is configured for all users
on the system:
$ sudo grep TMOUT /etc/profile

			Is it the case that value of TMOUT is not less than or equal to expected setting?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_max_concurrent_login_sessions_question:question:1">
      <question_text>
Run the following command to ensure the maxlogins value is configured for all users
on the system:
# grep "maxlogins" /etc/security/limits.conf
You should receive output similar to the following:
*		hard	maxlogins	

			Is it the case that maxlogins is not equal to or less than the expected value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_logon_fail_delay_question:question:1">
      <question_text>
Verify the FAIL_DELAY setting is configured correctly in the /etc/login.defs file by
running the following command:
$ sudo grep -i "FAIL_DELAY" /etc/login.defs
All output must show the value of FAIL_DELAY set as shown in the below:
$ sudo grep -i "FAIL_DELAY" /etc/login.defs
fail_delay 

			Is it the case that the above command returns no output, or FAIL_DELAY is configured less than the expected value?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_root_path_dirs_no_write_question:question:1">
      <question_text>
To ensure write permissions are disabled for group and other
 for each element in root's path, run the following command:
# ls -ld DIR

			Is it the case that group or other write permissions exist?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_home_dirs_question:question:1">
      <question_text>
To ensure the user home directory is not group-writable or world-readable, run the following:
# ls -ld /home/USER

			Is it the case that the user home directory is group-writable or world-readable?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_umask_etc_bashrc_question:question:1">
      <question_text>
Verify the umask setting is configured correctly in the /etc/bashrc file by
running the following command:
# grep "umask" /etc/bashrc
All output must show the value of umask set as shown below:
# grep "umask" /etc/bashrc
umask 
umask 

			Is it the case that the above command returns no output, or if the umask is configured incorrectly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_umask_etc_csh_cshrc_question:question:1">
      <question_text>
Verify the umask setting is configured correctly in the /etc/csh.cshrc file by
running the following command:
# grep "umask" /etc/csh.cshrc
All output must show the value of umask set as shown in the below:
# grep "umask" /etc/csh.cshrc
umask 

			Is it the case that the above command returns no output, or if the umask is configured incorrectly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_umask_etc_profile_question:question:1">
      <question_text>
Verify the umask setting is configured correctly in the /etc/profile file by
running the following command:
# grep "umask" /etc/profile
All output must show the value of umask set as shown in the below:
# grep "umask" /etc/profile
umask 

			Is it the case that the above command returns no output, or if the umask is configured incorrectly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-accounts_umask_etc_login_defs_question:question:1">
      <question_text>
Verify the UMASK setting is configured correctly in the /etc/login.defs file by
running the following command:
# grep -i "UMASK" /etc/login.defs
All output must show the value of umask set as shown in the below:
# grep -i "UMASK" /etc/login.defs
umask 

			Is it the case that the above command returns no output, or if the umask is configured incorrectly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_user_owner_grub2_cfg_question:question:1">
      <question_text>
              
    To check the ownership of /boot/grub2/grub.cfg, run the command:
    $ ls -lL /boot/grub2/grub.cfg
    If properly configured, the output should indicate the following owner:
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_group_owner_grub2_cfg_question:question:1">
      <question_text>
              
    To check the group ownership of /boot/grub2/grub.cfg, run the command:
    $ ls -lL /boot/grub2/grub.cfg
    If properly configured, the output should indicate the following group-owner.
    root
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_grub2_cfg_question:question:1">
      <question_text>
To check the permissions of /boot/grub2/grub.cfg, run the command:
$ sudo ls -lL /boot/grub2/grub.cfg
If properly configured, the output should indicate the following 
permissions: -rw-------

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-bootloader_password_question:question:1">
      <question_text>
To verify the boot loader superuser account and superuser account password have
been set, and the password encrypted, run the following command:
$ sudo grep -A1 "superusers\|password" /etc/grub2.cfg
The output should show the following:
set superusers="superusers-account"
password_pbkdf2 superusers-account password-hash

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-bootloader_uefi_password_question:question:1">
      <question_text>
To verify the boot loader superuser account and superuser account password have
been set, and the password encrypted, run the following command:
sudo grep -A1 "superusers\|password" /etc/grub2-efi.cfg
The output should show the following:
set superusers="superusers-account"
password_pbkdf2 superusers-account password-hash

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-require_singleuser_auth_question:question:1">
      <question_text>
To check if authentication is required for single-user mode, run the following command:
$ grep sulogin /usr/lib/systemd/system/rescue.service
The output should be similar to the following, and the line must begin with
ExecStart and /sbin/sulogin:
ExecStart=-/sbin/sulogin

			Is it the case that the output is different?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_debug-shell_disabled_question:question:1">
      <question_text>
            
        To check that the debug-shell service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled debug-shell
        Output should indicate the debug-shell service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled debug-shelldisabled

        Run the following command to verify debug-shell is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active debug-shell

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-disable_ctrlaltdel_reboot_question:question:1">
      <question_text>
To ensure the system is configured to mask the Ctrl-Alt-Del sequence,
enter the following command:
$ sudo ln -sf /dev/null /etc/systemd/system/ctrl-alt-del.target
or
$ sudo systemctl mask ctrl-alt-del.target

			Is it the case that the system is configured to reboot when Ctrl-Alt-Del is pressed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-disable_interactive_boot_question:question:1">
      <question_text>
Inspect /etc/default/grub for any instances of
systemd.confirm_spawn=(1|yes|true|on) in the kernel boot arguments.
Presence of a systemd.confirm_spawn=(1|yes|true|on) indicates
that interactive boot is enabled at boot time.

			Is it the case that Interactive boot is enabled at boot time?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_screen_installed_question:question:1">
      <question_text>
                
    Run the following command to determine if the screen package is installed:
    $ rpm -q screen
              
			Is it the case that the package is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-smartcard_auth_question:question:1">
      <question_text>
Interview the SA to determine if all accounts not exempted by policy are
using CAC authentication. 
For DoD systems, the following systems and accounts are exempt from using
smart card (CAC) authentication:
SIPRNET systemsStandalone systemsApplication accountsTemporary employee accounts, such as students or interns, who cannot easily receive a CAC or PIVOperational tactical locations that are not collocated with RAPIDS workstations to issue CAC or ALTTest systems, such as those with an Interim Approval to Test (IATT) and use a separate VPN, firewall, or security measure preventing access to network and system components from outside the protection boundary documented in the IATT.

			Is it the case that non-exempt accounts are not using CAC authentication?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-banner_etc_issue_question:question:1">
      <question_text>
To check if the system login banner is compliant,
run the following command:
$ cat /etc/issue

			Is it the case that it does not display the required banner?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_banner_enabled_question:question:1">
      <question_text>
To ensure a login warning banner is enabled, run the following:
$ grep banner-message-enable /etc/dconf/db/gdm.d/*
If properly configured, the output should be true.
To ensure a login warning banner is locked and cannot be changed by a user, run the following:
$ grep banner-message-enable /etc/dconf/db/gdm.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/banner-message-enable.

			Is it the case that it is not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-dconf_gnome_login_banner_text_question:question:1">
      <question_text>
To ensure the login warning banner text is properly set, run the following:
$ grep banner-message-text /etc/dconf/db/gdm.d/*
If properly configured, the proper banner text will appear.
To ensure the login warning banner text is locked and cannot be changed by a user, run the following:
$ grep banner-message-enable /etc/dconf/db/gdm.d/locks/*
If properly configured, the output should be /org/gnome/login-screen/banner-message-text.

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-network_disable_ddns_interfaces_question:question:1">
      <question_text>
To verify that clients cannot automatically update DNS records, perform the
following:
$ grep -i dhcp_hostname /etc/sysconfig/network-scripts/ifcfg-*
$ grep -rni "send host-name" /etc/dhclient.conf /etc/dhcp
The output should return no results.

			Is it the case that client Dynamic DNS updates are not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-network_sniffer_disabled_question:question:1">
      <question_text>
Promiscuous mode of an interface can be disabled with the following command:
$ sudo ip link set dev device_name promisc off

			Is it the case that any network device is in promiscuous mode?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_send_redirects_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.default.send_redirects kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.default.send_redirects
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_send_redirects_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.all.send_redirects kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.all.send_redirects
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_ip_forward_question:question:1">
      <question_text>
    The status of the net.ipv4.ip_forward kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.ip_forward
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
The ability to forward packets is only appropriate for routers.

			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_source_route_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.all.accept_source_route kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.all.accept_source_route
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_accept_redirects_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.all.accept_redirects kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.all.accept_redirects
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_secure_redirects_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.all.secure_redirects kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.all.secure_redirects
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_log_martians_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.all.log_martians kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.all.log_martians
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_log_martians_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.default.log_martians kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.default.log_martians
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_source_route_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.default.accept_source_route kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.default.accept_source_route
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_accept_redirects_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.default.accept_redirects kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.default.accept_redirects
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_secure_redirects_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.default.secure_redirects kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.default.secure_redirects
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts_question:question:1">
      <question_text>
              
    The status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.icmp_echo_ignore_broadcasts
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses_question:question:1">
      <question_text>
              
    The status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.icmp_ignore_bogus_error_responses
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_tcp_syncookies_question:question:1">
      <question_text>
              
    The status of the net.ipv4.tcp_syncookies kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.tcp_syncookies
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_all_rp_filter_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.all.rp_filter kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.all.rp_filter
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv4_conf_default_rp_filter_question:question:1">
      <question_text>
              
    The status of the net.ipv4.conf.default.rp_filter kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv4.conf.default.rp_filter
    The output of the command should indicate a value of 1.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
            
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_bluetooth_disabled_question:question:1">
      <question_text>
              
        To check that the bluetooth service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled bluetooth
        Output should indicate the bluetooth service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled bluetoothdisabled

        Run the following command to verify bluetooth is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active bluetooth

        If the service is not running the command will return the following output:
        inactive
            
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-kernel_module_bluetooth_disabled_question:question:1">
      <question_text>
              
If the system is configured to prevent the loading of the
bluetooth kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as
/bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d
and the deprecated /etc/modprobe.conf:
preserve$ grep -r bluetooth /etc/modprobe.conf /etc/modprobe.d
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_kernel_ipv6_disable_question:question:1">
      <question_text>
If the system uses IPv6, this is not applicable.

If the system is configured to prevent the usage of the
ipv6 on network interfaces, it will contain a line
of the form:
net.ipv6.conf.all.disable_ipv6 = 1
Such lines may be inside any file in the /etc/sysctl.d directory. 
This permits insertion of the IPv6 kernel module (which other parts of 
the system expect to be present), but otherwise keeps all network interfaces
from using IPv6.
Run the following command to search for such
lines in all files in /etc/sysctl.d:
preserve$ grep -r ipv6 /etc/sysctl.d

			Is it the case that the ipv6 support is disabled on network interfaces?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_source_route_question:question:1">
      <question_text>
                
    The status of the net.ipv6.conf.all.accept_source_route kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv6.conf.all.accept_source_route
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
              
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_ra_question:question:1">
      <question_text>
                
    The status of the net.ipv6.conf.all.accept_ra kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv6.conf.all.accept_ra
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
              
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_ra_question:question:1">
      <question_text>
                
    The status of the net.ipv6.conf.default.accept_ra kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv6.conf.default.accept_ra
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
              
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_question:question:1">
      <question_text>
                
    The status of the net.ipv6.conf.all.accept_redirects kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv6.conf.all.accept_redirects
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
              
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_redirects_question:question:1">
      <question_text>
                
    The status of the net.ipv6.conf.default.accept_redirects kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv6.conf.default.accept_redirects
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
              
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_default_accept_source_route_question:question:1">
      <question_text>
                
    The status of the net.ipv6.conf.default.accept_source_route kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv6.conf.default.accept_source_route
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
              
			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysctl_net_ipv6_conf_all_forwarding_question:question:1">
      <question_text>
    The status of the net.ipv6.conf.all.forwarding kernel parameter can be queried
    by running the following command:
    preserve$ sysctl net.ipv6.conf.all.forwarding
    The output of the command should indicate a value of 0.
    If this value is not the default value, investigate how it could have been
    adjusted at runtime, and verify it is not set improperly in
    /etc/sysctl.conf.
    
The ability to forward packets is only appropriate for routers.

			Is it the case that the correct value is not returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_firewalld_enabled_question:question:1">
      <question_text>
              
        Run the following command to determine the current status of the
firewalld service:
        $ systemctl is-active firewalld
        If the service is running, it should return the following: active
            
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-set_firewalld_default_zone_question:question:1">
      <question_text>
Inspect the file /etc/firewalld/firewalld.conf to determine
the default zone for the firewalld. It should be set to DefaultZone=drop:
$ sudo grep DefaultZone /etc/firewalld/firewalld.conf

			Is it the case that the default zone is not set to DROP?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-kernel_module_dccp_disabled_question:question:1">
      <question_text>
            
If the system is configured to prevent the loading of the
dccp kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as
/bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d
and the deprecated /etc/modprobe.conf:
preserve$ grep -r dccp /etc/modprobe.conf /etc/modprobe.d
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-kernel_module_sctp_disabled_question:question:1">
      <question_text>
            
If the system is configured to prevent the loading of the
sctp kernel module,
it will contain lines inside any file in /etc/modprobe.d or the deprecated/etc/modprobe.conf.
These lines instruct the module loading system to run another program (such as
/bin/true) upon a module install event.
Run the following command to search for such lines in all files in /etc/modprobe.d
and the deprecated /etc/modprobe.conf:
preserve$ grep -r sctp /etc/modprobe.conf /etc/modprobe.d
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_libreswan_installed_question:question:1">
      <question_text>
            
    Run the following command to determine if the libreswan package is installed:
    $ rpm -q libreswan
          
			Is it the case that the package is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-libreswan_approved_tunnels_question:question:1">
      <question_text>
To check for configured IPsec connections (conn), perform the following:
grep -rni conn /etc/ipsec.conf /etc/ipsec.d/
Verify any returned results for organizational approval.

			Is it the case that the IPSec tunnels are not approved?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_rsyslog_installed_question:question:1">
      <question_text>
          
    Run the following command to determine if the rsyslog package is installed:
    $ rpm -q rsyslog
        
			Is it the case that the package is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_rsyslog_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
rsyslog service:
        $ systemctl is-active rsyslog
        If the service is running, it should return the following: active
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rsyslog_files_ownership_question:question:1">
      <question_text>
The owner of all log files written by rsyslog should be root.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the owner of a given log file, run the following command:
$ ls -l LOGFILE

			Is it the case that the owner is not root?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rsyslog_files_groupownership_question:question:1">
      <question_text>
The group-owner of all log files written by rsyslog should be root.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the group-owner of a given log file, run the following command:
$ ls -l LOGFILE

			Is it the case that the group-owner is not root?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rsyslog_files_permissions_question:question:1">
      <question_text>
The file permissions for all log files written by rsyslog 
should be set to 600, or more restrictive.
These log files are determined by the second part of each Rule line in
/etc/rsyslog.conf and typically all appear in /var/log.
To see the permissions of a given log file, run the following command:
$ ls -l LOGFILE
The permissions should be 600, or more restrictive.

			Is it the case that the permissions are not correct?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rsyslog_cron_logging_question:question:1">
      <question_text>
To verify that cron is logging to rsyslog,
run the following command:
grep -rni "cron\.\*" /etc/rsyslog.*
The output should return some similar to:
cron.*                                                  /var/log/cron

			Is it the case that cron is not logging to rsyslog?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-rsyslog_remote_loghost_question:question:1">
      <question_text>
To ensure logs are sent to a remote host, examine the file
/etc/rsyslog.conf.
If using UDP, a line similar to the following should be present:
 *.* @loghost.example.com
If using TCP, a line similar to the following should be present:
 *.* @@loghost.example.com
If using RELP, a line similar to the following should be present:
 *.* :omrelp:loghost.example.com

			Is it the case that none of these are present?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ensure_logrotate_activated_question:question:1">
      <question_text>
To determine the status and frequency of logrotate, run the following command:
$ sudo grep logrotate /var/log/cron*
If logrotate is configured properly, output should include references to 
/etc/cron.daily.

			Is it the case that logrotate is not configured to run daily?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_auditd_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
auditd service:
        $ systemctl is-active auditd
        If the service is running, it should return the following: active
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-bootloader_audit_argument_question:question:1">
      <question_text>
Inspect the form of default GRUB 2 command line for the Linux operating system
in /etc/default/grub. If they include audit=1, then auditing
is enabled at boot time.

			Is it the case that auditing is not enabled at boot time?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-auditd_data_retention_num_logs_question:question:1">
      <question_text>
Inspect /etc/audit/auditd.conf and locate the following line to
determine how many logs the system is configured to retain after rotation:
$ sudo grep num_logs /etc/audit/auditd.conf
num_logs = 5

			Is it the case that the system log file retention has not been properly configured?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-auditd_data_retention_max_log_file_question:question:1">
      <question_text>
Inspect /etc/audit/auditd.conf and locate the following line to
determine how much data the system will retain in each audit log file:
$ sudo grep max_log_file /etc/audit/auditd.conf
max_log_file = 6

			Is it the case that the system audit data threshold has not been properly configured?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-auditd_data_retention_max_log_file_action_question:question:1">
      <question_text>
Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to rotate logs when they reach their
maximum size:
$ sudo grep max_log_file_action /etc/audit/auditd.conf
max_log_file_action rotate

			Is it the case that the system has not been properly configured to rotate audit logs?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-auditd_data_retention_space_left_action_question:question:1">
      <question_text>
Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to email the administrator when
disk space is starting to run low:
$ sudo grep space_left_action /etc/audit/auditd.conf
space_left_action
Acceptable values are email, suspend, single, and halt.

			Is it the case that the system is not configured to send an email to the system administrator when disk space is starting to run low?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-auditd_data_retention_admin_space_left_action_question:question:1">
      <question_text>
Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to either suspend, switch to single user mode,
or halt when disk space has run low:
admin_space_left_action single

			Is it the case that the system is not configured to switch to single user mode for corrective action?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-auditd_data_retention_action_mail_acct_question:question:1">
      <question_text>
Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to send email to an
account when it needs to notify an administrator:
action_mail_acct = root

			Is it the case that auditd is not configured to send emails per identified actions?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-auditd_data_retention_flush_question:question:1">
      <question_text>
Inspect /etc/audit/auditd.conf and locate the following line to
determine if the system is configured to synchronize audit event data
with the log files on the disk:
$ sudo grep flush /etc/audit/auditd.conf
flush = DATA
Acceptable values are DATA, and SYNC. The setting is
case-insensitive.

			Is it the case that auditd is not configured to synchronously write audit  event data to disk?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-auditd_audispd_syslog_plugin_activated_question:question:1">
      <question_text>
To verify the audispd's syslog plugin is active, run the following command:
$ sudo grep active /etc/audisp/plugins.d/syslog.conf
If the plugin is active, the output will show yes.

			Is it the case that it is not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_time_adjtimex_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the adjtimex
system call, run the following command:
preserve$ sudo grep "adjtimex" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that the system is not configured to audit time changes?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_time_settimeofday_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the settimeofday
system call, run the following command:
preserve$ sudo grep "settimeofday" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that the system is not configured to audit time changes?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_time_stime_question:question:1">
      <question_text>
If the system is not configured to audit time changes, this is a finding.
If the system is 64-bit only, this is not applicable

To determine if the system is configured to audit calls to
the stime
system call, run the following command:
preserve$ sudo grep "stime" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  

			Is it the case that the system is not configured to audit time changes?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_time_clock_settime_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the clock_settime
system call, run the following command:
preserve$ sudo grep "clock_settime" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that the system is not configured to audit time changes?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_time_watch_localtime_question:question:1">
      <question_text>
To determine if the system is configured to audit attempts to
alter time via the /etc/localtime file, run the following
command:
$ sudo auditctl -l | grep "watch=/etc/localtime"
If the system is configured to audit this activity, it will return a line.

			Is it the case that the system is not configured to audit time changes?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_usergroup_modification_question:question:1">
      <question_text>
To determine if the system is configured to audit account changes,
run the following command:
auditctl -l | egrep '(/etc/passwd|/etc/shadow|/etc/group|/etc/gshadow|/etc/security/opasswd)'
If the system is configured to watch for account changes, lines should be returned for
each file specified (and with perm=wa for each).

			Is it the case that the system is not configured to audit account changes?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_networkconfig_modification_question:question:1">
      <question_text>
To determine if the system is configured to audit changes to its network configuration,
run the following command:
auditctl -l | egrep '(/etc/issue|/etc/issue.net|/etc/hosts|/etc/sysconfig/network)'
If the system is configured to watch for network configuration changes, a line should be returned for
each file specified (and perm=wa should be indicated for each).

			Is it the case that the system is not configured to audit changes of the network configuration?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_var_log_audit_question:question:1">
      <question_text>
Run the following command to check the mode of the system audit logs:
$ sudo ls -l /var/log/audit
Audit logs must be mode 0640 or less permissive.

			Is it the case that any are more permissive?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_ownership_var_log_audit_question:question:1">
      <question_text>
            
    To check the ownership of /var/log, run the command:
    $ ls -lL /var/log
    If properly configured, the output should indicate the following owner:
    root
          
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_mac_modification_question:question:1">
      <question_text>
To determine if the system is configured to audit changes to its SELinux
configuration files, run the following command:
$ sudo auditctl -l | grep "dir=/etc/selinux"
If the system is configured to watch for changes to its SELinux
configuration, a line should be returned (including
perm=wa indicating permissions that are watched).

			Is it the case that the system is not configured to audit attempts to change the MAC policy?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_chmod_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the chmod
system call, run the following command:
preserve$ sudo grep "chmod" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that the system is not configured to audit permission changes?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_chown_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the chown
system call, run the following command:
preserve$ sudo grep "chown" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_fchmod_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the fchmod
system call, run the following command:
preserve$ sudo grep "fchmod" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_fchmodat_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the fchmodat
system call, run the following command:
preserve$ sudo grep "fchmodat" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_fchown_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the fchown
system call, run the following command:
preserve$ sudo grep "fchown" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_fchownat_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the fchownat
system call, run the following command:
preserve$ sudo grep "fchownat" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_fremovexattr_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the fremovexattr
system call, run the following command:
preserve$ sudo grep "fremovexattr" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_fsetxattr_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the fsetxattr
system call, run the following command:
preserve$ sudo grep "fsetxattr" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_lchown_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the lchown
system call, run the following command:
preserve$ sudo grep "lchown" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_lremovexattr_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the lremovexattr
system call, run the following command:
preserve$ sudo grep "lremovexattr" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_lsetxattr_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the lsetxattr
system call, run the following command:
preserve$ sudo grep "lsetxattr" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_removexattr_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the removexattr
system call, run the following command:
preserve$ sudo grep "removexattr" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_dac_modification_setxattr_question:question:1">
      <question_text>
              
To determine if the system is configured to audit calls to
the setxattr
system call, run the following command:
preserve$ sudo grep "setxattr" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_unsuccessful_file_modification_question:question:1">
      <question_text>
To verify that the audit system collects unauthorized file accesses, run the following commands:
$ sudo grep EACCES /etc/audit/audit.rules
$ sudo grep EPERM /etc/audit/audit.rules

			Is it the case that 32-bit and 64-bit system calls to creat, open, openat, open_by_handle_at, truncate, and ftruncate are not audited during EACCES and EPERM?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_privileged_commands_question:question:1">
      <question_text>
To verify that auditing of privileged command use is configured, run the
following command for each local partition PART to find relevant
setuid / setgid programs:
$ sudo find PART -xdev -type f -perm -4000 -o -type f -perm -2000 2&gt;/dev/null
Run the following command to verify entries in the audit rules for all programs
found with the previous command:
$ sudo grep path /etc/audit/audit.rules
It should be the case that all relevant setuid / setgid programs have a line
in the audit rules.

			Is it the case that it is not the case?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_media_export_question:question:1">
      <question_text>
To verify that auditing is configured for all media exportation events, run the following command:
$ sudo auditctl -l | grep syscall | grep mount

			Is it the case that there is not output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_file_deletion_events_question:question:1">
      <question_text>
            
To determine if the system is configured to audit calls to
the rmdir
system call, run the following command:
preserve$ sudo grep "rmdir" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
To determine if the system is configured to audit calls to
the unlink
system call, run the following command:
preserve$ sudo grep "unlink" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
To determine if the system is configured to audit calls to
the unlinkat
system call, run the following command:
preserve$ sudo grep "unlinkat" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
To determine if the system is configured to audit calls to
the rename
system call, run the following command:
preserve$ sudo grep "rename" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
To determine if the system is configured to audit calls to
the renameat
system call, run the following command:
preserve$ sudo grep "renameat" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_sysadmin_actions_question:question:1">
      <question_text>
To verify that auditing is configured for system administrator actions, run the following command:
$ sudo auditctl -l | grep "watch=/etc/sudoers"

			Is it the case that there is not output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-audit_rules_kernel_module_loading_question:question:1">
      <question_text>
            
To determine if the system is configured to audit calls to
the init_module
system call, run the following command:
preserve$ sudo grep "init_module" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
            
To determine if the system is configured to audit calls to
the delete_module
system call, run the following command:
preserve$ sudo grep "delete_module" /etc/audit/audit.rules
If the system is configured to audit this activity, it will return a line.
  
          
			Is it the case that no line is returned?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_xinetd_disabled_question:question:1">
      <question_text>
If network services are using the xinetd service, this is not applicable.


        To check that the xinetd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled xinetd
        Output should indicate the xinetd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled xinetddisabled

        Run the following command to verify xinetd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active xinetd

        If the service is not running the command will return the following output:
        inactive
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_xinetd_removed_question:question:1">
      <question_text>
If network services are using the xinetd service, this is not applicable.


    Run the following command to determine if the xinetd package is installed:
    $ rpm -q xinetd 
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_tcp_wrappers_installed_question:question:1">
      <question_text>
            
    Run the following command to determine if the tcp_wrappers package is installed:
    $ rpm -q tcp_wrappers
          
			Is it the case that the package is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_telnet_disabled_question:question:1">
      <question_text>
            
        To check that the telnet socket is disabled in system boot configuration with systemd, run the following command:
        $ systemctl is-enabled telnet
        Output should indicate the telnet socket has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled telnetdisabled

        Run the following command to verify telnet is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active telnet

        If the socket is not running the command will return the following output:
        inactive
            
        To check that the telnet service is disabled in system boot configuration with xinetd, run the following command:
        $ chkconfig telnet --list
        Output should indicate the telnet service has either not been installed, or has been disabled, as shown in the example below:
        $ chkconfig telnet --list

                  Note: This output shows SysV services only and does not include native
                  systemd services. SysV configuration data might be overridden by native
                  systemd configuration.

                  If you want to list systemd services use 'systemctl list-unit-files'.
                  To see services enabled on particular target use
                  'systemctl list-dependencies [target]'.

                  telnet       off
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_telnet-server_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the telnet-server package is installed:
    $ rpm -q telnet-server
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_telnet_removed_question:question:1">
      <question_text>
            
        The telnet package can be removed with the following command:
        $ sudo yum erase telnet
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_rsh-server_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the rsh-server package is installed:
    $ rpm -q rsh-server
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_rexec_disabled_question:question:1">
      <question_text>
            
        To check that the rexec socket is disabled in system boot configuration with systemd, run the following command:
        $ systemctl is-enabled rexec
        Output should indicate the rexec socket has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled rexecdisabled

        Run the following command to verify rexec is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active rexec

        If the socket is not running the command will return the following output:
        inactive
            
        To check that the rexec service is disabled in system boot configuration with xinetd, run the following command:
        $ chkconfig rexec --list
        Output should indicate the rexec service has either not been installed, or has been disabled, as shown in the example below:
        $ chkconfig rexec --list

                  Note: This output shows SysV services only and does not include native
                  systemd services. SysV configuration data might be overridden by native
                  systemd configuration.

                  If you want to list systemd services use 'systemctl list-unit-files'.
                  To see services enabled on particular target use
                  'systemctl list-dependencies [target]'.

                  rexec       off
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_rsh_disabled_question:question:1">
      <question_text>
            
        To check that the rsh socket is disabled in system boot configuration with systemd, run the following command:
        $ systemctl is-enabled rsh
        Output should indicate the rsh socket has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled rshdisabled

        Run the following command to verify rsh is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active rsh

        If the socket is not running the command will return the following output:
        inactive
            
        To check that the rsh service is disabled in system boot configuration with xinetd, run the following command:
        $ chkconfig rsh --list
        Output should indicate the rsh service has either not been installed, or has been disabled, as shown in the example below:
        $ chkconfig rsh --list

                  Note: This output shows SysV services only and does not include native
                  systemd services. SysV configuration data might be overridden by native
                  systemd configuration.

                  If you want to list systemd services use 'systemctl list-unit-files'.
                  To see services enabled on particular target use
                  'systemctl list-dependencies [target]'.

                  rsh       off
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_rsh_removed_question:question:1">
      <question_text>
            
        The rsh package can be removed with the following command:
        $ sudo yum erase rsh
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_rlogin_disabled_question:question:1">
      <question_text>
            
        To check that the rlogin socket is disabled in system boot configuration with systemd, run the following command:
        $ systemctl is-enabled rlogin
        Output should indicate the rlogin socket has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled rlogindisabled

        Run the following command to verify rlogin is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active rlogin

        If the socket is not running the command will return the following output:
        inactive
            
        To check that the rlogin service is disabled in system boot configuration with xinetd, run the following command:
        $ chkconfig rlogin --list
        Output should indicate the rlogin service has either not been installed, or has been disabled, as shown in the example below:
        $ chkconfig rlogin --list

                  Note: This output shows SysV services only and does not include native
                  systemd services. SysV configuration data might be overridden by native
                  systemd configuration.

                  If you want to list systemd services use 'systemctl list-unit-files'.
                  To see services enabled on particular target use
                  'systemctl list-dependencies [target]'.

                  rlogin       off
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-no_rsh_trust_files_question:question:1">
      <question_text>
The existence of the file /etc/hosts.equiv or a file named
.rhosts inside a user home directory indicates the presence
of an Rsh trust relationship.

			Is it the case that these files exist?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_ypserv_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the ypserv package is installed:
    $ rpm -q ypserv
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_ypbind_disabled_question:question:1">
      <question_text>
            
        To check that the ypbind service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled ypbind
        Output should indicate the ypbind service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled ypbinddisabled

        Run the following command to verify ypbind is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active ypbind

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_ypbind_removed_question:question:1">
      <question_text>
            
        The ypbind package can be removed with the following command:
        $ sudo yum erase ypbind
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_tftp_disabled_question:question:1">
      <question_text>
            
        To check that the tftp service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled tftp
        Output should indicate the tftp service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled tftpdisabled

        Run the following command to verify tftp is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active tftp

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_tftp-server_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the tftp-server package is installed:
    $ rpm -q tftp-server
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_tftp_removed_question:question:1">
      <question_text>
            
        The tftp package can be removed with the following command:
        $ sudo yum erase tftp
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-tftpd_uses_secure_mode_question:question:1">
      <question_text>
If TFTP is not installed, this is not applicable.  To determine if TFTP is installed, 
run the following command:
$ rpm -qa | grep tftp

Verify tftp is configured by with the -s option by running the
following command:
grep "server_args" /etc/xinetd.d/tftp
The output should indicate the server_args variable is configured with the -s
flag, matching the example below:
$ grep "server_args" /etc/xinetd.d/tftp
server_args = -s /var/lib/tftpboot

			Is it the case that this flag is missing?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_talk-server_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the talk-server package is installed:
    $ rpm -q talk-server
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_talk_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the talk package is installed:
    $ rpm -q talk
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_abrtd_disabled_question:question:1">
      <question_text>
          
        To check that the abrtd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled abrtd
        Output should indicate the abrtd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled abrtddisabled

        Run the following command to verify abrtd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active abrtd

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_acpid_disabled_question:question:1">
      <question_text>
          
        To check that the acpid service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled acpid
        Output should indicate the acpid service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled acpiddisabled

        Run the following command to verify acpid is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active acpid

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_certmonger_disabled_question:question:1">
      <question_text>
          
        To check that the certmonger service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled certmonger
        Output should indicate the certmonger service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled certmongerdisabled

        Run the following command to verify certmonger is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active certmonger

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_cgconfig_disabled_question:question:1">
      <question_text>
          
        To check that the cgconfig service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled cgconfig
        Output should indicate the cgconfig service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled cgconfigdisabled

        Run the following command to verify cgconfig is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active cgconfig

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_cgred_disabled_question:question:1">
      <question_text>
          
        To check that the cgred service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled cgred
        Output should indicate the cgred service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled cgreddisabled

        Run the following command to verify cgred is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active cgred

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_cpupower_disabled_question:question:1">
      <question_text>
          
        To check that the cpupower service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled cpupower
        Output should indicate the cpupower service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled cpupowerdisabled

        Run the following command to verify cpupower is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active cpupower

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_irqbalance_enabled_question:question:1">
      <question_text>
          
        To check that the irqbalance service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled irqbalance
        Output should indicate the irqbalance service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled irqbalancedisabled

        Run the following command to verify irqbalance is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active irqbalance

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_kdump_disabled_question:question:1">
      <question_text>
          
        To check that the kdump service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled kdump
        Output should indicate the kdump service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled kdumpdisabled

        Run the following command to verify kdump is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active kdump

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_mdmonitor_disabled_question:question:1">
      <question_text>
          
        To check that the mdmonitor service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled mdmonitor
        Output should indicate the mdmonitor service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled mdmonitordisabled

        Run the following command to verify mdmonitor is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active mdmonitor

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_messagebus_disabled_question:question:1">
      <question_text>
          
        To check that the messagebus service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled messagebus
        Output should indicate the messagebus service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled messagebusdisabled

        Run the following command to verify messagebus is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active messagebus

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_netconsole_disabled_question:question:1">
      <question_text>
          
        To check that the netconsole service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled netconsole
        Output should indicate the netconsole service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled netconsoledisabled

        Run the following command to verify netconsole is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active netconsole

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_ntpdate_disabled_question:question:1">
      <question_text>
          
        To check that the ntpdate service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled ntpdate
        Output should indicate the ntpdate service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled ntpdatedisabled

        Run the following command to verify ntpdate is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active ntpdate

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_oddjobd_disabled_question:question:1">
      <question_text>
          
        To check that the oddjobd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled oddjobd
        Output should indicate the oddjobd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled oddjobddisabled

        Run the following command to verify oddjobd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active oddjobd

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_portreserve_disabled_question:question:1">
      <question_text>
          
        To check that the portreserve service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled portreserve
        Output should indicate the portreserve service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled portreservedisabled

        Run the following command to verify portreserve is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active portreserve

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_psacct_enabled_question:question:1">
      <question_text>
          
        To check that the psacct service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled psacct
        Output should indicate the psacct service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled psacctdisabled

        Run the following command to verify psacct is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active psacct

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_qpidd_disabled_question:question:1">
      <question_text>
          
        To check that the qpidd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled qpidd
        Output should indicate the qpidd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled qpidddisabled

        Run the following command to verify qpidd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active qpidd

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_quota_nld_disabled_question:question:1">
      <question_text>
          
        To check that the quota_nld service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled quota_nld
        Output should indicate the quota_nld service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled quota_nlddisabled

        Run the following command to verify quota_nld is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active quota_nld

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_rdisc_disabled_question:question:1">
      <question_text>
          
        To check that the rdisc service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled rdisc
        Output should indicate the rdisc service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled rdiscdisabled

        Run the following command to verify rdisc is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active rdisc

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_rhnsd_disabled_question:question:1">
      <question_text>
          
        To check that the rhnsd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled rhnsd
        Output should indicate the rhnsd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled rhnsddisabled

        Run the following command to verify rhnsd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active rhnsd

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_rhsmcertd_disabled_question:question:1">
      <question_text>
          
        To check that the rhsmcertd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled rhsmcertd
        Output should indicate the rhsmcertd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled rhsmcertddisabled

        Run the following command to verify rhsmcertd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active rhsmcertd

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_saslauthd_disabled_question:question:1">
      <question_text>
          
        To check that the saslauthd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled saslauthd
        Output should indicate the saslauthd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled saslauthddisabled

        Run the following command to verify saslauthd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active saslauthd

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_smartd_disabled_question:question:1">
      <question_text>
          
        To check that the smartd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled smartd
        Output should indicate the smartd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled smartddisabled

        Run the following command to verify smartd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active smartd

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_sysstat_disabled_question:question:1">
      <question_text>
          
        To check that the sysstat service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled sysstat
        Output should indicate the sysstat service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled sysstatdisabled

        Run the following command to verify sysstat is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active sysstat

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_crond_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
crond service:
        $ systemctl is-active crond
        If the service is running, it should return the following: active
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-disable_anacron_question:question:1">
      <question_text>
          
    Run the following command to determine if the cronie-anacron package is installed:
    $ rpm -q cronie-anacron
        
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_atd_disabled_question:question:1">
      <question_text>
          
        To check that the atd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled atd
        Output should indicate the atd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled atddisabled

        Run the following command to verify atd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active atd

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_owner_cron_allow_question:question:1">
      <question_text>
            
    To check the ownership of /etc/cron.allow, run the command:
    $ ls -lL /etc/cron.allow
    If properly configured, the output should indicate the following owner:
    root
          
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_groupowner_cron_allow_question:question:1">
      <question_text>
            
    To check the group ownership of /etc/cron.allow, run the command:
    $ ls -lL /etc/cron.allow
    If properly configured, the output should indicate the following group-owner.
    root
          
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_docker_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
docker service:
        $ systemctl is-active docker
        If the service is running, it should return the following: active
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_openssh-server_installed_question:question:1">
      <question_text>
          
    Run the following command to determine if the openssh-server package is installed:
    $ rpm -q openssh-server
        
			Is it the case that the package is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_sshd_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
sshd service:
        $ systemctl is-active sshd
        If the service is running, it should return the following: active
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_sshd_pub_key_question:question:1">
      <question_text>
          
    To check the permissions of /etc/ssh/*.pub, run the command:
    $ ls -l /etc/ssh/*.pub
    If properly configured, the output should indicate the following permissions:
    -rw-r--r--
        
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-file_permissions_sshd_private_key_question:question:1">
      <question_text>
          
    To check the permissions of /etc/ssh/*_key, run the command:
    $ ls -l /etc/ssh/*_key
    If properly configured, the output should indicate the following permissions:
    -rw-r-----
        
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-firewalld_sshd_port_enabled_question:question:1">
      <question_text>
            
        To determine if firewalld is configured to allow access to ssh
        on port 22/tcp, run the following command(s):
        firewall-cmd --list-ports
        If firewalld is configured to allow access through the firewall, something similar to the following output
        if is a service:
        &gt;ssh
        Something similar to the following output if is a port:
        22/tcp
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_allow_only_protocol2_question:question:1">
      <question_text>
To check which SSH protocol version is allowed, run the following command:
$ sudo grep Protocol /etc/ssh/sshd_config
If configured properly, output should be Protocol 2

			Is it the case that it is commented out or is not set correctly to Protocol 2?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_disable_gssapi_auth_question:question:1">
      <question_text>
To check if GSSAPIAuthentication is disabled or set correctly, run the following
command:
$ sudo grep GSSAPIAuthentication /etc/ssh/sshd_config
If configured properly, output should be no

			Is it the case that it is commented out or is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_disable_kerb_auth_question:question:1">
      <question_text>
To check if KerberosAuthentication is disabled or set correctly, run the
following command:
$ sudo grep KerberosAuthentication /etc/ssh/sshd_config
If configured properly, output should be no

			Is it the case that it is commented out or is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_enable_strictmodes_question:question:1">
      <question_text>
To check if StrictModes is enabled or set correctly, run the
following command:
$ sudo grep StrictModes /etc/ssh/sshd_config
If configured properly, output should be yes

			Is it the case that it is commented out or is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_use_priv_separation_question:question:1">
      <question_text>
To check if UsePrivilegeSeparation is enabled or set correctly, run the
following command:
$ sudo grep UsePrivilegeSeparation /etc/ssh/sshd_config
If configured properly, output should be yes

			Is it the case that it is commented out or is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_disable_compression_question:question:1">
      <question_text>
To check if compression is enabled or set correctly, run the
following command:
$ sudo grep Compression /etc/ssh/sshd_config
If configured properly, output should be no or delayed.

			Is it the case that it is commented out, or is not set to no or delayed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_print_last_log_question:question:1">
      <question_text>
To check if PrintLastLog is enabled or set correctly, run the
following command:
$ sudo grep PrintLastLog /etc/ssh/sshd_config
If configured properly, output should be yes

			Is it the case that it is commented out or is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_set_idle_timeout_question:question:1">
      <question_text>
Run the following command to see what the timeout interval is:
$ sudo grep ClientAliveInterval /etc/ssh/sshd_config
If properly configured, the output should be:
ClientAliveInterval 600

			Is it the case that it is commented out or not configured properly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_set_keepalive_question:question:1">
      <question_text>
To ensure the SSH idle timeout will occur when the ClientAliveCountMax is set, run the following command:
$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config
If properly configured, output should be:
ClientAliveCountMax 0

			Is it the case that it is commented out or not configured properly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_disable_rhosts_question:question:1">
      <question_text>
            
    To determine how the SSH daemon's
    IgnoreRhosts
    option is set, run the following command:
    preserve$ sudo grep -i IgnoreRhosts /etc/ssh/sshd_config
      If no line, a commented line, or a line indicating the value
      yes is returned, then the required value is set.
    
          
			Is it the case that the required value is not set?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_disable_user_known_hosts_question:question:1">
      <question_text>
            
    To determine how the SSH daemon's
    IgnoreUserKnownHosts
    option is set, run the following command:
    preserve$ sudo grep -i IgnoreUserKnownHosts /etc/ssh/sshd_config
      If a line indicating yes is returned, then the required value is set.
    
          
			Is it the case that the required value is not set?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_disable_rhosts_rsa_question:question:1">
      <question_text>
            
    To determine how the SSH daemon's
    RhostsRSAAuthentication
    option is set, run the following command:
    preserve$ sudo grep -i RhostsRSAAuthentication /etc/ssh/sshd_config
      If no line, a commented line, or a line indicating the value
      no is returned, then the required value is set.
    
          
			Is it the case that the required value is not set?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-disable_host_auth_question:question:1">
      <question_text>
            
    To determine how the SSH daemon's
    HostbasedAuthentication
    option is set, run the following command:
    preserve$ sudo grep -i HostbasedAuthentication /etc/ssh/sshd_config
      If no line, a commented line, or a line indicating the value
      no is returned, then the required value is set.
    
          
			Is it the case that the required value is not set?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-enable_x11_forwarding_question:question:1">
      <question_text>
            
    To determine how the SSH daemon's
    X11Forwarding
    option is set, run the following command:
    preserve$ sudo grep -i X11Forwarding /etc/ssh/sshd_config
      If a line indicating yes is returned, then the required value is set.
    
          
			Is it the case that the required value is not set?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_disable_root_login_question:question:1">
      <question_text>
            
    To determine how the SSH daemon's
    PermitRootLogin
    option is set, run the following command:
    preserve$ sudo grep -i PermitRootLogin /etc/ssh/sshd_config
      If a line indicating no is returned, then the required value is set.
    
          
			Is it the case that the required value is not set?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_disable_empty_passwords_question:question:1">
      <question_text>
            
    To determine how the SSH daemon's
    PermitEmptyPasswords
    option is set, run the following command:
    preserve$ sudo grep -i PermitEmptyPasswords /etc/ssh/sshd_config
      If no line, a commented line, or a line indicating the value
      no is returned, then the required value is set.
    
          
			Is it the case that the required value is not set?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_enable_warning_banner_question:question:1">
      <question_text>
            
    To determine how the SSH daemon's
    Banner
    option is set, run the following command:
    preserve$ sudo grep -i Banner /etc/ssh/sshd_config
      If a line indicating /etc/issue is returned, then the required value is set.
    
          
			Is it the case that the required value is not set?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_do_not_permit_user_env_question:question:1">
      <question_text>
To ensure users are not able to present environment daemons, run the following command:
$ sudo grep PermitUserEnvironment /etc/ssh/sshd_config
If properly configured, output should be:
PermitUserEnvironment no

			Is it the case that PermitUserEnvironment is not disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_use_approved_ciphers_question:question:1">
      <question_text>
Only FIPS-approved ciphers should be used.  To verify that only FIPS-approved
ciphers are in use, run the following command:
$ sudo grep Ciphers /etc/ssh/sshd_config
The output should contain only those ciphers which are FIPS-approved, namely,
aes128-ctr,aes192-ctr,aes256-ctr

			Is it the case that FIPS ciphers are not configured or the enabled ciphers are not FIPS-approved?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sshd_use_approved_macs_question:question:1">
      <question_text>
Only FIPS-approved MACs should be used.  To verify that only FIPS-approved
MACs are in use, run the following command:
$ sudo grep -i macs /etc/ssh/sshd_config
The output should contain only those MACs which are FIPS-approved, namely,
hmac-sha2-512 and hmac-sha2-256 hash functions.


			Is it the case that MACs option is commented out or not using FIPS-approved hash algorithms?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_sssd_installed_question:question:1">
      <question_text>
          
    Run the following command to determine if the sssd package is installed:
    $ rpm -q sssd
        
			Is it the case that the package is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_sssd_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
sssd service:
        $ systemctl is-active sssd
        If the service is running, it should return the following: active
        
			Is it the case that the service is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sssd_memcache_timeout_question:question:1">
      <question_text>
To verify that SSSD's in-memory cache expires after a day, run the following command:
$ sudo grep memcache_timeout /etc/sssd/sssd.conf
If configured properly, output should be memcache_timeout = 86400.

			Is it the case that it does not exist or is not configured properly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sssd_offline_cred_expiration_question:question:1">
      <question_text>
To verify that SSSD expires offline credentials, run the following command:
$ sudo grep offline_credentials_expiration
If configured properly, output should be
offline_credentials_expiration = 1

			Is it the case that it does not exist or is not configured properly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sssd_ssh_known_hosts_timeout_question:question:1">
      <question_text>
To verify that SSSD expires known SSH host keys, run the following command:
$ sudo grep ssh_known_hosts_timeout
If configured properly, output should be
ssh_known_hosts_timeout = 86400

			Is it the case that it does not exist or is not configured properly?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-xwindows_runlevel_setting_question:question:1">
      <question_text>
To verify the default target is multi-user, run the following command:
$ systemctl get-default
The output should show the following:
multi-user.target

			Is it the case that the X windows display server is running and/or has not been disabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_xorg-x11-server-common_removed_question:question:1">
      <question_text>
To ensure the X Windows package group is removed, run the following command:
$ rpm -qi xorg-x11-server-common
The output should be:
package xorg-x11-server-common is not installed

			Is it the case that the X Windows package group or xorg-x11-server-common has not be removed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_avahi-daemon_disabled_question:question:1">
      <question_text>
            
        To check that the avahi-daemon service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled avahi-daemon
        Output should indicate the avahi-daemon service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled avahi-daemondisabled

        Run the following command to verify avahi-daemon is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active avahi-daemon

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_cups_disabled_question:question:1">
      <question_text>
          
        To check that the cups service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled cups
        Output should indicate the cups service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled cupsdisabled

        Run the following command to verify cups is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active cups

        If the service is not running the command will return the following output:
        inactive
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_dhcpd_disabled_question:question:1">
      <question_text>
            
        To check that the dhcpd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled dhcpd
        Output should indicate the dhcpd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled dhcpddisabled

        Run the following command to verify dhcpd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active dhcpd

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_dhcp_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the dhcp package is installed:
    $ rpm -q dhcp
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-sysconfig_networking_bootproto_ifcfg_question:question:1">
      <question_text>
To verify that DHCP is not being used, examine the following file for each interface:
# /etc/sysconfig/network-scripts/ifcfg-interface
Look for the following:
BOOTPROTO=none
and the following, substituting the appropriate values based on your site's addressing scheme:
NETMASK=255.255.255.0
IPADDR=192.168.1.2
GATEWAY=192.168.1.1

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_chronyd_or_ntpd_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
chronyd service:
        $ systemctl is-active chronyd
        If the service is running, it should return the following: active
          
        Run the following command to determine the current status of the
ntpd service:
        $ systemctl is-active ntpd
        If the service is running, it should return the following: active
        
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-chronyd_or_ntpd_specify_remote_server_question:question:1">
      <question_text>
To verify that a remote NTP service is configured for time synchronization,
open the following file:
/etc/chrony.conf in the case the system in question is
configured to use the chronyd as the NTP daemon (default setting)/etc/ntp.conf in the case the system in question is configured
to use the ntpd as the NTP daemon
In the file, there should be a section similar to the following:
server ntpserver

			Is it the case that this is not the case?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_postfix_enabled_question:question:1">
      <question_text>
          
        Run the following command to determine the current status of the
postfix service:
        $ systemctl is-active postfix
        If the service is running, it should return the following: active
        
			Is it the case that the system is not a cross domain solution and the service is not enabled?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_sendmail_removed_question:question:1">
      <question_text>
          
    Run the following command to determine if the sendmail package is installed:
    $ rpm -q sendmail
        
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-postfix_network_listening_disabled_question:question:1">
      <question_text>
Run the following command to ensure postfix accepts mail messages from only the local system:
$ grep inet_interfaces /etc/postfix/main.cf
If properly configured, the output should show only localhost.

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ldap_client_start_tls_question:question:1">
      <question_text>
If the system is not using TLS, set the ssl option in /etc/pam_ldap.conf
to start_tls.

			Is it the case that the 'ssl' option is not 'start_tls'?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ldap_client_tls_cacertpath_question:question:1">
      <question_text>
To ensure TLS is configured with trust certificates, run the following command:
$ grep cert /etc/nslcd.conf

			Is it the case that there is no output, or the lines are commented out?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_openldap-servers_removed_question:question:1">
      <question_text>
To verify the openldap-servers package is not installed, 
run the following command:
$ rpm -q openldap-servers
The output should show the following:
package openldap-servers is not installed

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-nfs_no_anonymous_question:question:1">
      <question_text>
Inspect the mounts configured in /etc/exports. Each mount should specify a value
greater than UID_MAX and GID_MAX as defined in /etc/login.defs.

			Is it the case that anonuid or anongid are not set to a value greater than UID_MAX (for anonuid) and GID_MAX (for anongid)?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_nfs_disabled_question:question:1">
      <question_text>
              
        To check that the nfs service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled nfs
        Output should indicate the nfs service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled nfsdisabled

        Run the following command to verify nfs is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active nfs

        If the service is not running the command will return the following output:
        inactive
            
			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_rpcsvcgssd_disabled_question:question:1">
      <question_text>
              
        To check that the rpcsvcgssd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled rpcsvcgssd
        Output should indicate the rpcsvcgssd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled rpcsvcgssddisabled

        Run the following command to verify rpcsvcgssd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active rpcsvcgssd

        If the service is not running the command will return the following output:
        inactive
            
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-mount_option_nodev_remote_filesystems_question:question:1">
      <question_text>
To verify the nodev option is configured for all NFS mounts, run the following command:
$ mount | grep nfs
All NFS mounts should show the nodev setting in parentheses.  This is not applicable if NFS is 
not implemented.

			Is it the case that the setting does not show?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-mount_option_nosuid_remote_filesystems_question:question:1">
      <question_text>
To verify the nosuid option is configured for all NFS mounts, run the following command:
$ mount | grep nfs
All NFS mounts should show the nosuid setting in parentheses.  This is not applicable if NFS is 
not implemented.

			Is it the case that the setting does not show?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-mount_option_krb_sec_remote_filesystems_question:question:1">
      <question_text>
To verify the sec option is configured for all NFS mounts, run the following command:
$ mount | grep "sec="
All NFS mounts should show the sec=krb5:krb5i:krb5p setting in parentheses.
This is not applicable if NFS is not implemented.

			Is it the case that the setting is not configured, has the 'sys' option added, or does not have all Kerberos options added?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-no_insecure_locks_exports_question:question:1">
      <question_text>
To verify insecure file locking has been disabled, run the following command:
$ grep insecure_locks /etc/exports

			Is it the case that there is output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-use_kerberos_security_all_exports_question:question:1">
      <question_text>
To verify the sec option is configured for all NFS mounts, run the following command:
$ grep "sec=" /etc/exports
All configured NFS exports should show the sec=krb5:krb5i:krb5p setting in parentheses.
This is not applicable if NFS is not implemented.

			Is it the case that the setting is not configured, has the 'sys' option added, or does not have all Kerberos options added?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_named_disabled_question:question:1">
      <question_text>
            
        To check that the named service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled named
        Output should indicate the named service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled nameddisabled

        Run the following command to verify named is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active named

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_bind_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the bind package is installed:
    $ rpm -q bind
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_vsftpd_disabled_question:question:1">
      <question_text>
            
        To check that the vsftpd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled vsftpd
        Output should indicate the vsftpd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled vsftpddisabled

        Run the following command to verify vsftpd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active vsftpd

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_vsftpd_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the vsftpd package is installed:
    $ rpm -q vsftpd
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ftp_log_transactions_question:question:1">
      <question_text>
Find if logging is applied to the FTP daemon.

Procedures:

If vsftpd is started by xinetd the following command will indicate the xinetd.d startup file:
$ grep vsftpd /etc/xinetd.d/*
$ grep server_args vsftpd xinetd.d startup file
This will indicate the vsftpd config file used when starting through xinetd.
If the server_args line is missing or does not include the vsftpd configuration file, then the default config file (/etc/vsftpd/vsftpd.conf) is used.
$ sudo grep xferlog_enable vsftpd config file

			Is it the case that xferlog_enable is missing, or is not set to yes?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-ftp_present_banner_question:question:1">
      <question_text>
If FTP services are not installed, this is not applicable.

To verify this configuration, run the following command:
grep "banner_file" /etc/vsftpd/vsftpd.conf

The output should show the value of banner_file is set to /etc/issue, an example of which is shown below:
$ sudo grep "banner_file" /etc/vsftpd/vsftpd.conf
banner_file=/etc/issue

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_httpd_disabled_question:question:1">
      <question_text>
            
        To check that the httpd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled httpd
        Output should indicate the httpd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled httpddisabled

        Run the following command to verify httpd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active httpd

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_httpd_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the httpd package is installed:
    $ rpm -q httpd
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_dovecot_disabled_question:question:1">
      <question_text>
            
        To check that the dovecot service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled dovecot
        Output should indicate the dovecot service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled dovecotdisabled

        Run the following command to verify dovecot is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active dovecot

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_dovecot_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the dovecot package is installed:
    $ rpm -q dovecot
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_zebra_disabled_question:question:1">
      <question_text>
            
        To check that the zebra service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled zebra
        Output should indicate the zebra service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled zebradisabled

        Run the following command to verify zebra is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active zebra

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_quagga_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the quagga package is installed:
    $ rpm -q quagga
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_smb_disabled_question:question:1">
      <question_text>
            
        To check that the smb service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled smb
        Output should indicate the smb service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled smbdisabled

        Run the following command to verify smb is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active smb

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_samba_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the samba package is installed:
    $ rpm -q samba
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_samba-common_installed_question:question:1">
      <question_text>
            
    Run the following command to determine if the samba-common package is installed:
    $ rpm -q samba-common
          
			Is it the case that the package is not installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-require_smb_client_signing_question:question:1">
      <question_text>
To verify that Samba clients running smbclient must use packet signing, run the following command:
$ grep signing /etc/samba/smb.conf
The output should show:
client signing = mandatory

			Is it the case that it is not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-mount_option_smb_client_signing_question:question:1">
      <question_text>
To verify that Samba clients using mount.cifs must use packet signing, run the following command:
$ grep sec /etc/fstab
The output should show either krb5i or ntlmv2i in use.

			Is it the case that it does not?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_squid_disabled_question:question:1">
      <question_text>
            
        To check that the squid service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled squid
        Output should indicate the squid service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled squiddisabled

        Run the following command to verify squid is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active squid

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_squid_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the squid package is installed:
    $ rpm -q squid
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-service_snmpd_disabled_question:question:1">
      <question_text>
            
        To check that the snmpd service is disabled in system boot configuration, run the following command:
        $ systemctl is-enabled snmpd
        Output should indicate the snmpd service has either not been installed,
        or has been disabled at all runlevels, as shown in the example below:
        $ systemctl is-enabled snmpddisabled

        Run the following command to verify snmpd is not active (i.e. not running) through current runtime configuration:
        $ systemctl is-active snmpd

        If the service is not running the command will return the following output:
        inactive
          
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-package_net-snmp_removed_question:question:1">
      <question_text>
            
    Run the following command to determine if the net-snmp package is installed:
    $ rpm -q net-snmp
          
			Is it the case that the package is installed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-snmpd_use_newer_protocol_question:question:1">
      <question_text>
To ensure only SNMPv3 or newer is used, run the following command:
$ sudo grep 'rocommunity\|rwcommunity\|com2sec' /etc/snmp/snmpd.conf | grep -v "^#"
There should be no output.

			Is it the case that there is output?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-snmpd_not_default_password_question:question:1">
      <question_text>
To ensure the default password is not set, run the following command:
$ sudo grep -v "^#" /etc/snmp/snmpd.conf| grep -E 'public|private'
There should be no output.

			Is it the case that the default SNMP passwords public and private have not been changed or removed?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-met_inherently_generic_question:question:1">
      <question_text>RHEL7 supports this requirement and cannot be configured to be out of 
compliance. This is a permanent not a finding. 

			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-met_inherently_auditing_question:question:1">
      <question_text>The RHEL7 auditing system supports this requirement and cannot be configured to be out of 
compliance. Every audit record in RHEL includes a timestamp, the operation attempted,
success or failure of the operation, the subject involved (executable/process),
the object involved (file/path), and security labels for the subject and object.
It also includes the ability to label events with custom key labels.  The auditing system
centralizes the recording of audit events for the entire system and includes
reduction (ausearch), reporting (aureport), and real-time
response (audispd) facilities.
This is a permanent not a finding. 

			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-met_inherently_nonselected_question:question:1">
      <question_text>RHEL7 supports this requirement and cannot be configured to be out of 
compliance. This is a permanent not a finding. 

			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-unmet_nonfinding_nonselected_scope_question:question:1">
      <question_text> 
RHEL7 cannot support this requirement without assistance from an external 
application, policy, or service. This requirement is NA. 

			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-unmet_finding_nonselected_question:question:1">
      <question_text>
This is a permanent finding.

			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-unmet_nonfinding_scope_question:question:1">
      <question_text> 
RHEL7 cannot support this requirement without assistance from an external 
application, policy, or service. This requirement is NA. 

			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-update_process_question:question:1">
      <question_text>
Ask an administrator if a process exists to promptly and automatically apply OS
software updates.  If such a process does not exist, this is a finding.

If the OS update process limits automatic updates of software packages, where 
such updates would impede normal system operation, to scheduled maintenance 
windows, but still within IAVM-dictated timeframes, this is not a finding.

			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-c2s_procedural_requirement_question:question:1">
      <question_text>TBD
			Is it the case that ?
			</question_text>
    </boolean_question>
    <boolean_question id="ocil:ssg-c2s_met_inherently_question:question:1">
      <question_text>RHEL7 supports this requirement and cannot be configured to be out of
compliance. This is a permanent not a finding.

			Is it the case that ?
			</question_text>
    </boolean_question>
  </questions>
</ocil>