From 990a7f5c986043b48fa0a86461c9cb0a71deb1b5 Mon Sep 17 00:00:00 2001
From: Evgeny Kolesnikov <ekolesni@redhat.com>
Date: Tue, 9 Jan 2024 14:35:17 +0100
Subject: [PATCH] Move install_mcafee_hbss shared OVAL to the install_hids rule

This rule is the only used of this "shared" OVAL.

On top of that the shared OVAL uses definitions from
the rule(s) of that group. Which is insane, and needs fixing,
but let's at least keep the insanity a bit more contained for
now.
---
 .../install_hids/oval/shared.xml              | 12 ++++++++
 shared/checks/oval/install_mcafee_hbss.xml    | 28 -------------------
 2 files changed, 12 insertions(+), 28 deletions(-)
 delete mode 100644 shared/checks/oval/install_mcafee_hbss.xml

diff --git a/linux_os/guide/system/software/integrity/endpoint_security_software/install_hids/oval/shared.xml b/linux_os/guide/system/software/integrity/endpoint_security_software/install_hids/oval/shared.xml
index fdb4cfb3c90..35732420213 100644
--- a/linux_os/guide/system/software/integrity/endpoint_security_software/install_hids/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/endpoint_security_software/install_hids/oval/shared.xml
@@ -1,4 +1,16 @@
 <def-group>
+
+  <definition class="compliance" id="install_mcafee_hbss"
+  version="1">
+    {{{ oval_metadata("Install McAfee Host-Based Intrusion Detection Software (HBSS)") }}}
+    <criteria operator="AND">
+      <extend_definition comment="McAfee HBSS" definition_ref="install_mcafee_cma_rt" />
+      <extend_definition comment="McAfee HBSS" definition_ref="install_mcafee_hbss_accm" />
+      <extend_definition comment="McAfee HBSS" definition_ref="package_MFEhiplsm_installed" />
+      <extend_definition comment="McAfee HBSS" definition_ref="install_mcafee_hbss_pa" />
+    </criteria>
+  </definition>
+
   <definition class="compliance" id="install_hids"
   version="1">
     {{{ oval_metadata("Intrusion detection software or SELinux should be installed and enabled.") }}}
diff --git a/shared/checks/oval/install_mcafee_hbss.xml b/shared/checks/oval/install_mcafee_hbss.xml
deleted file mode 100644
index ae2203571a3..00000000000
--- a/shared/checks/oval/install_mcafee_hbss.xml
+++ /dev/null
@@ -1,28 +0,0 @@
-<def-group>
-  <definition class="compliance" id="install_mcafee_hbss"
-  version="1">
-    <metadata>
-      <title>Install McAfee Host-Based Intrusion Detection Software (HBSS)</title>
-      <affected family="unix">
-	<platform>multi_platform_debian</platform>
-	<platform>multi_platform_fedora</platform>
-	<platform>multi_platform_opensuse</platform>
-	<platform>multi_platform_ol</platform>
-	<platform>multi_platform_rhcos</platform>
-	<platform>multi_platform_rhel</platform>
-	<platform>multi_platform_rhv</platform>
-	<platform>multi_platform_sle</platform>
-	<platform>multi_platform_ubuntu</platform>
-      </affected>
-      <description>McAfee Host-Based Intrusion Detection Software (HBSS) software
-      should be installed.</description>
-    </metadata>
-    <criteria operator="AND">
-      <extend_definition comment="McAfee HBSS" definition_ref="install_mcafee_cma_rt" />
-      <extend_definition comment="McAfee HBSS" definition_ref="install_mcafee_hbss_accm" />
-      <extend_definition comment="McAfee HBSS" definition_ref="package_MFEhiplsm_installed" />
-      <extend_definition comment="McAfee HBSS" definition_ref="install_mcafee_hbss_pa" />
-    </criteria>
-  </definition>
-
-</def-group>