From 8ac8a868433bc5d3f57cf8fc05d8ef445f7130a9 Mon Sep 17 00:00:00 2001
From: Israel Villar Boillos <israel.villar@ulpgc.es>
Date: Wed, 16 Sep 2026 21:57:20 +0100
Subject: [PATCH 1/7] Add Tripwire integrity rules

Tripwire is a common alternative to AIDE for file and directory
integrity checking, but the guide only covers AIDE. Adds a tripwire
group mirroring the existing aide group:

- package_tripwire_installed (from template).
- tripwire_build_database: check-only, verifies /var/lib/tripwire/*.twd
  exists; no remediation because tripwire --init requires the site and
  local passphrases to be entered interactively.
- tripwire_periodic_cron_checking: check-only, verifies a
  "tripwire --check" cron entry exists (the Debian package ships
  /etc/cron.daily/tripwire by default).

Adds the tripwire component.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 components/tripwire.yml                       |  9 ++++
 .../software-integrity/tripwire/group.yml     | 12 +++++
 .../package_tripwire_installed/rule.yml       | 23 ++++++++++
 .../tripwire_build_database/oval/shared.xml   | 20 ++++++++
 .../tripwire/tripwire_build_database/rule.yml | 37 +++++++++++++++
 .../oval/shared.xml                           | 46 +++++++++++++++++++
 .../tripwire_periodic_cron_checking/rule.yml  | 28 +++++++++++
 7 files changed, 175 insertions(+)
 create mode 100644 components/tripwire.yml
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/group.yml
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/package_tripwire_installed/rule.yml
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/oval/shared.xml
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/rule.yml
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml

diff --git a/components/tripwire.yml b/components/tripwire.yml
new file mode 100644
index 00000000000..715fb367b0a
--- /dev/null
+++ b/components/tripwire.yml
@@ -0,0 +1,9 @@
+name: tripwire
+groups:
+  - tripwire
+packages:
+  - tripwire
+rules:
+  - package_tripwire_installed
+  - tripwire_build_database
+  - tripwire_periodic_cron_checking
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/group.yml b/linux_os/guide/system/software/integrity/software-integrity/tripwire/group.yml
new file mode 100644
index 00000000000..77fbad04def
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/group.yml
@@ -0,0 +1,12 @@
+documentation_complete: true
+
+title: 'Verify Integrity with Tripwire'
+
+description: |-
+    Tripwire conducts integrity checks by comparing hashes and metadata of
+    files against a previously-generated, known-good database. It is a
+    common alternative to AIDE for this purpose. The database should be
+    created immediately after initial system configuration and regenerated
+    after any software update.
+
+platform: system_with_kernel
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/package_tripwire_installed/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/tripwire/package_tripwire_installed/rule.yml
new file mode 100644
index 00000000000..9088f9ee9f1
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/package_tripwire_installed/rule.yml
@@ -0,0 +1,23 @@
+documentation_complete: true
+
+title: 'Install Tripwire'
+
+description: |-
+    {{{ describe_package_install(package="tripwire") }}}
+
+rationale: |-
+    The tripwire package provides the Tripwire file and directory integrity
+    checker, a common alternative to AIDE. It must be installed for any
+    integrity checking to be possible.
+
+severity: medium
+
+references:
+    nist: CM-6(a)
+
+{{{ complete_ocil_entry_package_installed("tripwire") }}}
+
+template:
+    name: package_installed
+    vars:
+        pkgname: tripwire
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/oval/shared.xml
new file mode 100644
index 00000000000..e2465eed119
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/oval/shared.xml
@@ -0,0 +1,20 @@
+<def-group>
+  <definition class="compliance" id="{{{ rule_id }}}" version="1">
+    {{{ oval_metadata("The Tripwire database must be initialized to provide a known-good baseline for integrity checks.", rule_title=rule_title) }}}
+    <criteria operator="AND">
+      <extend_definition comment="tripwire is installed" definition_ref="package_tripwire_installed" />
+      <criterion test_ref="test_tripwire_database_initialized" comment="Tripwire operational database file exists" />
+    </criteria>
+  </definition>
+
+  <unix:file_test id="test_tripwire_database_initialized" check="all"
+  check_existence="at_least_one_exists" version="1"
+  comment="Testing existence of the Tripwire operational database file">
+    <unix:object object_ref="object_tripwire_database_file" />
+  </unix:file_test>
+
+  <unix:file_object id="object_tripwire_database_file" version="1">
+    <unix:path>/var/lib/tripwire</unix:path>
+    <unix:filename operation="pattern match">^.*\.twd$</unix:filename>
+  </unix:file_object>
+</def-group>
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/rule.yml
new file mode 100644
index 00000000000..3dfc3913cc4
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/rule.yml
@@ -0,0 +1,37 @@
+documentation_complete: true
+
+title: 'Build and Initialize Tripwire Database'
+
+description: |-
+    Run the following command to generate the initial known-good database,
+    supplying the local passphrase when prompted:
+    <pre>$ sudo tripwire --init</pre>
+    By default the database is written to
+    <tt>/var/lib/tripwire/$(HOSTNAME).twd</tt>, as configured by the
+    <tt>DBFILE</tt> directive in <tt>/etc/tripwire/twcfg.txt</tt>.
+    To run a manual integrity check afterwards:
+    <pre>$ sudo tripwire --check</pre>
+    If the check produces unexpected output, investigate.
+
+rationale: |-
+    For Tripwire to be effective, an initial database of "known-good"
+    information about files must be captured so that installed files can be
+    verified against it.
+
+severity: medium
+
+references:
+    nist: CM-6(a)
+
+warnings:
+    - general: |-
+        This rule doesn't come with a remediation; <tt>tripwire --init</tt>
+        requires the site and local passphrases to be entered interactively
+        and must be run by the administrator.
+
+ocil_clause: 'the Tripwire database file has not been created'
+
+ocil: |-
+    To verify the Tripwire database has been initialized, run:
+    <pre>$ sudo ls -l /var/lib/tripwire/*.twd</pre>
+    A <tt>.twd</tt> database file should be present.
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml
new file mode 100644
index 00000000000..4418af98cf9
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml
@@ -0,0 +1,46 @@
+<def-group>
+  <definition class="compliance" id="{{{ rule_id }}}" version="1">
+    {{{ oval_metadata("Tripwire must run on a schedule so unexpected file changes are revealed promptly.", rule_title=rule_title) }}}
+    <criteria operator="AND">
+      <extend_definition comment="tripwire is installed" definition_ref="package_tripwire_installed" />
+      <criteria operator="OR">
+        <criterion test_ref="test_tripwire_cron_periodic" comment="tripwire check scheduled in /etc/cron.{daily,weekly,hourly}" />
+        <criterion test_ref="test_tripwire_cron_d" comment="tripwire check scheduled in /etc/cron.d" />
+        <criterion test_ref="test_tripwire_crontab" comment="tripwire check scheduled in /etc/crontab" />
+      </criteria>
+    </criteria>
+  </definition>
+
+  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
+  id="test_tripwire_cron_periodic" version="1"
+  comment="tripwire check scheduled via /etc/cron.{daily,weekly,hourly}">
+    <ind:object object_ref="object_tripwire_cron_periodic" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_tripwire_cron_periodic" version="1">
+    <ind:path operation="pattern match">^/etc/cron\.(daily|weekly|hourly)$</ind:path>
+    <ind:filename operation="pattern match">^.*$</ind:filename>
+    <ind:pattern operation="pattern match">tripwire[^\n]*(?:--check|-m\s+c)</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
+  id="test_tripwire_cron_d" version="1" comment="tripwire check scheduled via /etc/cron.d">
+    <ind:object object_ref="object_tripwire_cron_d" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_tripwire_cron_d" version="1">
+    <ind:path>/etc/cron.d</ind:path>
+    <ind:filename operation="pattern match">^.*$</ind:filename>
+    <ind:pattern operation="pattern match">tripwire[^\n]*(?:--check|-m\s+c)</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+
+  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
+  id="test_tripwire_crontab" version="1" comment="tripwire check scheduled via /etc/crontab">
+    <ind:object object_ref="object_tripwire_crontab" />
+  </ind:textfilecontent54_test>
+  <ind:textfilecontent54_object id="object_tripwire_crontab" version="1">
+    <ind:filepath>/etc/crontab</ind:filepath>
+    <ind:pattern operation="pattern match">tripwire[^\n]*(?:--check|-m\s+c)</ind:pattern>
+    <ind:instance datatype="int">1</ind:instance>
+  </ind:textfilecontent54_object>
+</def-group>
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml
new file mode 100644
index 00000000000..d2ce10d3f26
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml
@@ -0,0 +1,28 @@
+documentation_complete: true
+
+title: 'Configure Periodic Execution of Tripwire'
+
+description: |-
+    Tripwire should run at least weekly. The Debian <tt>tripwire</tt> package
+    installs <tt>/etc/cron.daily/tripwire</tt>, which runs
+    <tt>tripwire --check</tt> once a day and mails the report to root.
+    To schedule it explicitly instead, add a line such as the following to
+    <tt>/etc/crontab</tt>:
+    <pre>05 4 * * * root /usr/sbin/tripwire --check</pre>
+
+rationale: |-
+    By default, integrity checking tools do not run themselves periodically.
+    Running Tripwire on a schedule is necessary to reveal unexpected changes
+    to installed files in a timely manner.
+
+severity: medium
+
+references:
+    nist: SI-7,SI-7(1),CM-6(a)
+
+ocil_clause: 'Tripwire is not configured to run periodically'
+
+ocil: |-
+    Run the following command to check for a scheduled Tripwire run:
+    <pre>$ ls -l /etc/cron.daily/tripwire /etc/cron.weekly/tripwire 2>/dev/null; grep -r tripwire /etc/crontab /etc/cron.d/</pre>
+    A cron entry invoking <tt>tripwire --check</tt> should be present.

From bc279292ef563ef5308a3ca8091d7d3980e1a509 Mon Sep 17 00:00:00 2001
From: Israel Villar Boillos <israel.villar@ulpgc.es>
Date: Wed, 16 Sep 2026 22:17:54 +0100
Subject: [PATCH 2/7] Add Automatus test scenarios for tripwire_build_database
 and tripwire_periodic_cron_checking

Both rules have custom OVAL (not template-based), so they aren't
covered by any template's built-in test suite.

- tripwire_build_database: pass when a *.twd file exists under
  /var/lib/tripwire, fail when none does.
- tripwire_periodic_cron_checking: pass both via the Debian package's
  own /etc/cron.daily/tripwire (verified against the real packaged
  file content, no admin action needed) and via an explicit
  /etc/cron.d entry (covers the OVAL's other OR branch); fail when no
  schedule exists at all.

All scenarios add linux-base to the packages list so the
system_with_kernel platform gate (inherited from the tripwire group,
mirroring aide's) evaluates true in the Docker test container, which
otherwise has no kernel package and would report every scenario as
not applicable.

Verified with Automatus against the debian13 test container: all 5
scenarios evaluate as expected.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../tripwire_build_database/tests/database_missing.fail.sh | 7 +++++++
 .../tripwire_build_database/tests/database_present.pass.sh | 6 ++++++
 .../tests/cron_d_entry.pass.sh                             | 6 ++++++
 .../tests/no_schedule.fail.sh                              | 7 +++++++
 .../tests/packaged_default.pass.sh                         | 6 ++++++
 5 files changed, 32 insertions(+)
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_missing.fail.sh
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_present.pass.sh
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_d_entry.pass.sh
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh

diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_missing.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_missing.fail.sh
new file mode 100644
index 00000000000..ad00dab4799
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_missing.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+# remediation = none
+
+mkdir -p /var/lib/tripwire
+rm -f /var/lib/tripwire/*.twd
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_present.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_present.pass.sh
new file mode 100644
index 00000000000..026f35d3ed3
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_present.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+
+mkdir -p /var/lib/tripwire
+touch "/var/lib/tripwire/$(hostname).twd"
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_d_entry.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_d_entry.pass.sh
new file mode 100644
index 00000000000..eceb3170289
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_d_entry.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+
+mkdir -p /etc/cron.d
+echo "05 4 * * * root /usr/sbin/tripwire --check" > /etc/cron.d/tripwire-check
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
new file mode 100644
index 00000000000..d3bd77be0df
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
@@ -0,0 +1,7 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+# remediation = none
+
+rm -f /etc/cron.daily/tripwire /etc/cron.weekly/tripwire /etc/cron.hourly/tripwire /etc/cron.d/tripwire*
+sed -i '/tripwire/d' /etc/crontab 2>/dev/null || true
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh
new file mode 100644
index 00000000000..2bb5f939385
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh
@@ -0,0 +1,6 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+
+# The Debian tripwire package ships /etc/cron.daily/tripwire out of the box;
+# no administrator action is needed for this scenario to pass.

From 916c2fa302c96517d88e52abb2417727e1156662 Mon Sep 17 00:00:00 2001
From: Israel Villar Boillos <israel.villar@ulpgc.es>
Date: Wed, 16 Sep 2026 22:23:58 +0100
Subject: [PATCH 3/7] Make tripwire_periodic_cron_checking scenarios
 self-contained

packaged_default.pass.sh relied silently on the tripwire package's
post-install state instead of asserting it, which is fragile across
package versions (aide_periodic_cron_checking's own test suite never
relies on implicit package defaults, always writing the expected
content explicitly, even though the AIDE package also installs a
default cron.daily script). Writes the real /etc/cron.daily/tripwire
content directly instead.

Also adds crontab_entry.pass.sh, covering the /etc/crontab method the
rule's own description documents as the explicit alternative to the
packaged default.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../tests/crontab_entry.pass.sh                   |  5 +++++
 .../tests/packaged_default.pass.sh                | 15 +++++++++++++--
 2 files changed, 18 insertions(+), 2 deletions(-)
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/crontab_entry.pass.sh

diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/crontab_entry.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/crontab_entry.pass.sh
new file mode 100644
index 00000000000..ab27fb68ef2
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/crontab_entry.pass.sh
@@ -0,0 +1,5 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+
+echo "05 4 * * * root /usr/sbin/tripwire --check" >> /etc/crontab
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh
index 2bb5f939385..8c96f93cb69 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh
@@ -2,5 +2,16 @@
 # packages = tripwire,linux-base
 # platform = multi_platform_debian
 
-# The Debian tripwire package ships /etc/cron.daily/tripwire out of the box;
-# no administrator action is needed for this scenario to pass.
+# Matches the /etc/cron.daily/tripwire script shipped by the Debian
+# tripwire package, written explicitly instead of relying on the
+# package's post-install state so this scenario stays deterministic
+# across package versions.
+mkdir -p /etc/cron.daily
+cat > /etc/cron.daily/tripwire <<EOF
+#!/bin/sh -e
+tripwire=/usr/sbin/tripwire
+[ -x \$tripwire ] || exit 0
+umask 027
+\$tripwire --check --quiet --email-report
+EOF
+chmod +x /etc/cron.daily/tripwire

From 4b5c825d52dc6d4305d9b7e3e247b29053c7ef30 Mon Sep 17 00:00:00 2001
From: Israel Villar Boillos <israel.villar@ulpgc.es>
Date: Wed, 16 Sep 2026 22:27:41 +0100
Subject: [PATCH 4/7] Simplify tripwire_periodic_cron_checking to the real
 Debian behavior

The /etc/cron.d and /etc/crontab OVAL branches (and their tests) were
speculative flexibility carried over from aide_periodic_cron_checking,
not grounded in how Tripwire is actually scheduled on Debian. A real
Debian 13 host running tripwire confirms the package relies solely on
/etc/cron.daily/tripwire; there is no crontab line or cron.d file for
it.

Drops both branches from the OVAL and the corresponding description/
ocil text, keeping only the /etc/cron.{daily,weekly,hourly} check
(generalized beyond "daily" so an administrator can relocate the
script to a less frequent cron directory). Replaces
cron_d_entry.pass.sh/crontab_entry.pass.sh with cron_weekly.pass.sh,
which exercises that relocation instead of a scenario with no
real-world basis.

Verified with Automatus against the debian13 test container: all 3
remaining scenarios evaluate as expected, and a full
--datastream-only build stays clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../oval/shared.xml                           | 27 +------------------
 .../tripwire_periodic_cron_checking/rule.yml  | 13 +++++----
 .../tests/cron_d_entry.pass.sh                |  6 -----
 .../tests/cron_weekly.pass.sh                 | 16 +++++++++++
 .../tests/crontab_entry.pass.sh               |  5 ----
 .../tests/no_schedule.fail.sh                 |  3 +--
 6 files changed, 24 insertions(+), 46 deletions(-)
 delete mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_d_entry.pass.sh
 create mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_weekly.pass.sh
 delete mode 100644 linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/crontab_entry.pass.sh

diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml
index 4418af98cf9..94414d8e912 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml
@@ -3,11 +3,7 @@
     {{{ oval_metadata("Tripwire must run on a schedule so unexpected file changes are revealed promptly.", rule_title=rule_title) }}}
     <criteria operator="AND">
       <extend_definition comment="tripwire is installed" definition_ref="package_tripwire_installed" />
-      <criteria operator="OR">
-        <criterion test_ref="test_tripwire_cron_periodic" comment="tripwire check scheduled in /etc/cron.{daily,weekly,hourly}" />
-        <criterion test_ref="test_tripwire_cron_d" comment="tripwire check scheduled in /etc/cron.d" />
-        <criterion test_ref="test_tripwire_crontab" comment="tripwire check scheduled in /etc/crontab" />
-      </criteria>
+      <criterion test_ref="test_tripwire_cron_periodic" comment="tripwire check scheduled in /etc/cron.{daily,weekly,hourly}" />
     </criteria>
   </definition>
 
@@ -22,25 +18,4 @@
     <ind:pattern operation="pattern match">tripwire[^\n]*(?:--check|-m\s+c)</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
-  id="test_tripwire_cron_d" version="1" comment="tripwire check scheduled via /etc/cron.d">
-    <ind:object object_ref="object_tripwire_cron_d" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="object_tripwire_cron_d" version="1">
-    <ind:path>/etc/cron.d</ind:path>
-    <ind:filename operation="pattern match">^.*$</ind:filename>
-    <ind:pattern operation="pattern match">tripwire[^\n]*(?:--check|-m\s+c)</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
-  id="test_tripwire_crontab" version="1" comment="tripwire check scheduled via /etc/crontab">
-    <ind:object object_ref="object_tripwire_crontab" />
-  </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="object_tripwire_crontab" version="1">
-    <ind:filepath>/etc/crontab</ind:filepath>
-    <ind:pattern operation="pattern match">tripwire[^\n]*(?:--check|-m\s+c)</ind:pattern>
-    <ind:instance datatype="int">1</ind:instance>
-  </ind:textfilecontent54_object>
 </def-group>
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml
index d2ce10d3f26..063881772f3 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml
@@ -4,11 +4,10 @@ title: 'Configure Periodic Execution of Tripwire'
 
 description: |-
     Tripwire should run at least weekly. The Debian <tt>tripwire</tt> package
-    installs <tt>/etc/cron.daily/tripwire</tt>, which runs
-    <tt>tripwire --check</tt> once a day and mails the report to root.
-    To schedule it explicitly instead, add a line such as the following to
-    <tt>/etc/crontab</tt>:
-    <pre>05 4 * * * root /usr/sbin/tripwire --check</pre>
+    installs <tt>/etc/cron.daily/tripwire</tt> by default, which runs
+    <tt>tripwire --check</tt> once a day and mails the report to root. If
+    daily checks are too frequent, the script can instead be moved to
+    <tt>/etc/cron.weekly</tt> or <tt>/etc/cron.hourly</tt>.
 
 rationale: |-
     By default, integrity checking tools do not run themselves periodically.
@@ -24,5 +23,5 @@ ocil_clause: 'Tripwire is not configured to run periodically'
 
 ocil: |-
     Run the following command to check for a scheduled Tripwire run:
-    <pre>$ ls -l /etc/cron.daily/tripwire /etc/cron.weekly/tripwire 2>/dev/null; grep -r tripwire /etc/crontab /etc/cron.d/</pre>
-    A cron entry invoking <tt>tripwire --check</tt> should be present.
+    <pre>$ ls -l /etc/cron.daily/tripwire /etc/cron.weekly/tripwire /etc/cron.hourly/tripwire 2>/dev/null</pre>
+    A script invoking <tt>tripwire --check</tt> should be present.
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_d_entry.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_d_entry.pass.sh
deleted file mode 100644
index eceb3170289..00000000000
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_d_entry.pass.sh
+++ /dev/null
@@ -1,6 +0,0 @@
-#!/bin/bash
-# packages = tripwire,linux-base
-# platform = multi_platform_debian
-
-mkdir -p /etc/cron.d
-echo "05 4 * * * root /usr/sbin/tripwire --check" > /etc/cron.d/tripwire-check
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_weekly.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_weekly.pass.sh
new file mode 100644
index 00000000000..2b77b508f8d
--- /dev/null
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_weekly.pass.sh
@@ -0,0 +1,16 @@
+#!/bin/bash
+# packages = tripwire,linux-base
+# platform = multi_platform_debian
+
+# The Debian package's default script may be relocated to a less
+# frequent cron directory if daily checks are too frequent.
+rm -f /etc/cron.daily/tripwire
+mkdir -p /etc/cron.weekly
+cat > /etc/cron.weekly/tripwire <<EOF
+#!/bin/sh -e
+tripwire=/usr/sbin/tripwire
+[ -x \$tripwire ] || exit 0
+umask 027
+\$tripwire --check --quiet --email-report
+EOF
+chmod +x /etc/cron.weekly/tripwire
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/crontab_entry.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/crontab_entry.pass.sh
deleted file mode 100644
index ab27fb68ef2..00000000000
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/crontab_entry.pass.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/bin/bash
-# packages = tripwire,linux-base
-# platform = multi_platform_debian
-
-echo "05 4 * * * root /usr/sbin/tripwire --check" >> /etc/crontab
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
index d3bd77be0df..3ec60ad397c 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
@@ -3,5 +3,4 @@
 # platform = multi_platform_debian
 # remediation = none
 
-rm -f /etc/cron.daily/tripwire /etc/cron.weekly/tripwire /etc/cron.hourly/tripwire /etc/cron.d/tripwire*
-sed -i '/tripwire/d' /etc/crontab 2>/dev/null || true
+rm -f /etc/cron.daily/tripwire /etc/cron.weekly/tripwire /etc/cron.hourly/tripwire

From 59cd6fac89fe69ea7f1dad549bf2e2fb3eec8b9e Mon Sep 17 00:00:00 2001
From: Israel Villar Boillos <israel.villar@ulpgc.es>
Date: Wed, 16 Sep 2026 22:39:41 +0100
Subject: [PATCH 5/7] Drop /etc/cron.hourly from
 tripwire_periodic_cron_checking

Hourly was another untested, speculative option (Tripwire integrity
checks are too heavy for hourly runs, and it isn't part of the rule's
own "at least weekly" rationale). Narrows the OVAL path pattern and
description/ocil text to just /etc/cron.daily (the packaged default)
and /etc/cron.weekly, matching aide_periodic_cron_checking's own
cron.(daily|weekly) pattern.

Verified with Automatus against the debian13 test container: all 3
scenarios evaluate as expected, and a full --datastream-only build
stays clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../tripwire_periodic_cron_checking/oval/shared.xml       | 6 +++---
 .../tripwire/tripwire_periodic_cron_checking/rule.yml     | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml
index 94414d8e912..d5bbcd9132c 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/oval/shared.xml
@@ -3,17 +3,17 @@
     {{{ oval_metadata("Tripwire must run on a schedule so unexpected file changes are revealed promptly.", rule_title=rule_title) }}}
     <criteria operator="AND">
       <extend_definition comment="tripwire is installed" definition_ref="package_tripwire_installed" />
-      <criterion test_ref="test_tripwire_cron_periodic" comment="tripwire check scheduled in /etc/cron.{daily,weekly,hourly}" />
+      <criterion test_ref="test_tripwire_cron_periodic" comment="tripwire check scheduled in /etc/cron.{daily,weekly}" />
     </criteria>
   </definition>
 
   <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
   id="test_tripwire_cron_periodic" version="1"
-  comment="tripwire check scheduled via /etc/cron.{daily,weekly,hourly}">
+  comment="tripwire check scheduled via /etc/cron.{daily,weekly}">
     <ind:object object_ref="object_tripwire_cron_periodic" />
   </ind:textfilecontent54_test>
   <ind:textfilecontent54_object id="object_tripwire_cron_periodic" version="1">
-    <ind:path operation="pattern match">^/etc/cron\.(daily|weekly|hourly)$</ind:path>
+    <ind:path operation="pattern match">^/etc/cron\.(daily|weekly)$</ind:path>
     <ind:filename operation="pattern match">^.*$</ind:filename>
     <ind:pattern operation="pattern match">tripwire[^\n]*(?:--check|-m\s+c)</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml
index 063881772f3..4c61dea4dfb 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/rule.yml
@@ -5,9 +5,9 @@ title: 'Configure Periodic Execution of Tripwire'
 description: |-
     Tripwire should run at least weekly. The Debian <tt>tripwire</tt> package
     installs <tt>/etc/cron.daily/tripwire</tt> by default, which runs
-    <tt>tripwire --check</tt> once a day and mails the report to root. If
-    daily checks are too frequent, the script can instead be moved to
-    <tt>/etc/cron.weekly</tt> or <tt>/etc/cron.hourly</tt>.
+    <tt>tripwire --check</tt> once a day and mails the report to root. The
+    script can instead be moved to <tt>/etc/cron.weekly</tt> if weekly checks
+    are preferred.
 
 rationale: |-
     By default, integrity checking tools do not run themselves periodically.
@@ -23,5 +23,5 @@ ocil_clause: 'Tripwire is not configured to run periodically'
 
 ocil: |-
     Run the following command to check for a scheduled Tripwire run:
-    <pre>$ ls -l /etc/cron.daily/tripwire /etc/cron.weekly/tripwire /etc/cron.hourly/tripwire 2>/dev/null</pre>
+    <pre>$ ls -l /etc/cron.daily/tripwire /etc/cron.weekly/tripwire 2>/dev/null</pre>
     A script invoking <tt>tripwire --check</tt> should be present.

From 59ad6d6716637caf3f8c8d36f1585de87ecf1b47 Mon Sep 17 00:00:00 2001
From: Israel Villar Boillos <israel.villar@ulpgc.es>
Date: Wed, 16 Sep 2026 22:41:49 +0100
Subject: [PATCH 6/7] Drop stray cron.hourly reference from no_schedule.fail.sh

Leftover from before hourly was dropped from the rule; harmless
(rm -f on a nonexistent path is a no-op) but inconsistent with the
rule's current scope.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../tripwire_periodic_cron_checking/tests/no_schedule.fail.sh   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
index 3ec60ad397c..37a981e6410 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
@@ -3,4 +3,4 @@
 # platform = multi_platform_debian
 # remediation = none
 
-rm -f /etc/cron.daily/tripwire /etc/cron.weekly/tripwire /etc/cron.hourly/tripwire
+rm -f /etc/cron.daily/tripwire /etc/cron.weekly/tripwire

From 2f8e5151f3ea0182c9d9aaa31d09b58e1184ab7c Mon Sep 17 00:00:00 2001
From: Israel Villar Boillos <israel.villar@ulpgc.es>
Date: Fri, 18 Sep 2026 07:23:29 +0100
Subject: [PATCH 7/7] Document expected results in tripwire test scenarios

Add or extend a comment on each Automatus test scenario explaining
what it exercises and the expected pass/fail outcome, as requested in
review.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../tripwire_build_database/tests/database_missing.fail.sh      | 2 ++
 .../tripwire_build_database/tests/database_present.pass.sh      | 2 ++
 .../tripwire_periodic_cron_checking/tests/cron_weekly.pass.sh   | 1 +
 .../tripwire_periodic_cron_checking/tests/no_schedule.fail.sh   | 2 ++
 .../tests/packaged_default.pass.sh                              | 2 +-
 5 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_missing.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_missing.fail.sh
index ad00dab4799..682998ca5c3 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_missing.fail.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_missing.fail.sh
@@ -3,5 +3,7 @@
 # platform = multi_platform_debian
 # remediation = none
 
+# No .twd database file exists yet, so the Tripwire database hasn't been
+# initialized. Expected result: FAIL.
 mkdir -p /var/lib/tripwire
 rm -f /var/lib/tripwire/*.twd
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_present.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_present.pass.sh
index 026f35d3ed3..ec0435a326f 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_present.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_build_database/tests/database_present.pass.sh
@@ -2,5 +2,7 @@
 # packages = tripwire,linux-base
 # platform = multi_platform_debian
 
+# A .twd database file is present, matching the DBFILE default documented
+# in twconfig(4) (/var/lib/tripwire/$(HOSTNAME).twd). Expected result: PASS.
 mkdir -p /var/lib/tripwire
 touch "/var/lib/tripwire/$(hostname).twd"
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_weekly.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_weekly.pass.sh
index 2b77b508f8d..cfa77be8ffd 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_weekly.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/cron_weekly.pass.sh
@@ -4,6 +4,7 @@
 
 # The Debian package's default script may be relocated to a less
 # frequent cron directory if daily checks are too frequent.
+# Expected result: PASS.
 rm -f /etc/cron.daily/tripwire
 mkdir -p /etc/cron.weekly
 cat > /etc/cron.weekly/tripwire <<EOF
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
index 37a981e6410..76fe77b4378 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/no_schedule.fail.sh
@@ -3,4 +3,6 @@
 # platform = multi_platform_debian
 # remediation = none
 
+# Neither /etc/cron.daily/tripwire nor /etc/cron.weekly/tripwire exists,
+# so no periodic check is scheduled. Expected result: FAIL.
 rm -f /etc/cron.daily/tripwire /etc/cron.weekly/tripwire
diff --git a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh
index 8c96f93cb69..8dfcdfc817a 100644
--- a/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh
+++ b/linux_os/guide/system/software/integrity/software-integrity/tripwire/tripwire_periodic_cron_checking/tests/packaged_default.pass.sh
@@ -5,7 +5,7 @@
 # Matches the /etc/cron.daily/tripwire script shipped by the Debian
 # tripwire package, written explicitly instead of relying on the
 # package's post-install state so this scenario stays deterministic
-# across package versions.
+# across package versions. Expected result: PASS.
 mkdir -p /etc/cron.daily
 cat > /etc/cron.daily/tripwire <<EOF
 #!/bin/sh -e