<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("All User Files and Directories In The Home Directory Must Have Mode 0750 Or Less Permissive") }}}
    <criteria operator="AND">
      <criterion test_ref="test_accounts_users_home_files_permissions_files"
                 comment="All files under interactive user's Home Directories must have proper permissions"/>
      <criterion test_ref="test_accounts_users_home_files_permissions_dirs"
                 comment="All direcories under home directories must have proper permissions"/>
    </criteria>
  </definition>

  {{%- set interactive_users_home_dirs_object = "object_" ~ rule_id ~ "_home_dirs" -%}}
  {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_home_dirs_object) }}}

  <!-- #### prepare for test_file_permissions_home_directories #### -->
  <local_variable id="var_accounts_users_home_files_permissions_dirs" datatype="string" version="1"
                  comment="Variable including all home dirs from interactive users">
    <object_component item_field="subexpression" object_ref="{{{ interactive_users_home_dirs_object }}}"/>
  </local_variable>
  <!-- #### creation of object #### -->
  <unix:file_object id="object_accounts_users_home_files_permissions_dirs" version="1">
    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1"
                    recurse_file_system="local"/>
    <unix:path var_ref="var_accounts_users_home_files_permissions_dirs" var_check="at least one"/>
    <unix:filename xsi:nil="true" />
  </unix:file_object>
  <unix:file_state id="state_accounts_users_home_files_permissions_is_symlink" version="1">
    <unix:type operation="equals">symbolic link</unix:type>
  </unix:file_state>
  <unix:file_object id="object_accounts_users_home_files_permissions_files" version="1">
    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1"
                    recurse_file_system="local"/>
    <unix:path var_ref="var_accounts_users_home_files_permissions_dirs" var_check="at least one"/>
    <unix:filename operation="pattern match">^[^\.].*</unix:filename>
    <filter action="exclude">state_accounts_users_home_files_permissions_is_symlink</filter>
  </unix:file_object>
  <!-- #### creation of state #### -->
  <unix:file_state id="state_accounts_users_home_files_permissions_dirs" version="1" operator='AND'>
    <unix:suid datatype="boolean">false</unix:suid>
    <unix:sgid datatype="boolean">false</unix:sgid>
    <unix:sticky datatype="boolean">false</unix:sticky>
    <unix:gwrite datatype="boolean">false</unix:gwrite>
    <unix:oread datatype="boolean">false</unix:oread>
    <unix:owrite datatype="boolean">false</unix:owrite>
    <unix:oexec datatype="boolean">false</unix:oexec>
  </unix:file_state>
  <!-- #### creation of test #### -->
  <unix:file_test id="test_accounts_users_home_files_permissions_files" check="all"
                  check_existence="any_exist"
                  version="1" comment="All files into home directories have proper permissions">
    <unix:object object_ref="object_accounts_users_home_files_permissions_files"/>
    <unix:state state_ref="state_accounts_users_home_files_permissions_dirs"/>
  </unix:file_test>
  <unix:file_test id="test_accounts_users_home_files_permissions_dirs" check="all"
                  check_existence="any_exist" version="1"
                  comment="All directories into home directories have proper permissions">
    <unix:object object_ref="object_accounts_users_home_files_permissions_dirs"/>
    <unix:state state_ref="state_accounts_users_home_files_permissions_dirs"/>
  </unix:file_test>
</def-group>
