control 'SELinux enforcing check' do
  title 'Check SELinux is enforcing'
  desc 'SELinux should be in enforcing mode for security compliance.'

  describe command('getenforce') do
    its('stdout') { should match /Permissive/ }
  end

  describe command('semodule -l') do
    its('stdout') { should match /custom_cron_policy/ }
  end
end