<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("All interactive user's Home Directories must be group-owned by its user") }}}
    <criteria>
      <criterion test_ref="test_file_groupownership_home_directories"
                 comment="All interactive user's Home Directories must be group-owned by its user"/>
    </criteria>
  </definition>

  {{%- set interactive_users_home_dirs_object = "object_" ~ rule_id ~ "_home_dirs" -%}}
  {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_home_dirs_object) }}}
  {{%- set interactive_users_gids_object = "object_" ~ rule_id ~ "_gids" -%}}
  {{{ create_local_interactive_users_gids_list_object(interactive_users_gids_object) }}}

  <!-- #### prepare for test_file_groupownership_home_directories #### -->
  <local_variable id="var_file_groupownership_home_directories_dirs" datatype="string" version="1"
                  comment="Variable including all home dirs from primary interactive groups">
    <object_component item_field="subexpression" object_ref="{{{ interactive_users_home_dirs_object  }}}"/>
  </local_variable>

  <local_variable id="var_file_groupownership_home_directories_gids" datatype="int" version="1"
                  comment="Variable including all gids from primary interactive group">
    <object_component item_field="subexpression" object_ref="{{{ interactive_users_gids_object }}}"/>
  </local_variable>

  <!-- #### creation of object #### -->
  <unix:file_object id="object_file_groupownership_home_directories_dirs" version="1">
    <unix:path var_ref="var_file_groupownership_home_directories_dirs" var_check="at least one"/>
    <unix:filename xsi:nil="true"/>
  </unix:file_object>

  <!-- #### creation of state #### -->
  <unix:file_state id="state_file_groupownership_home_directories_gids" version="1">
    <unix:group_id datatype="int" var_check="only one" var_ref="var_file_groupownership_home_directories_gids"/>
  </unix:file_state>

  <!-- #### creation of test #### -->
  <!-- #### creatin of test_file_groupownership_home_directories #### -->
  <unix:file_test id="test_file_groupownership_home_directories" check="all" check_existence="any_exist"
                  version="1" comment="All home directories are group-owned by a local interactive group">
    <unix:object object_ref="object_file_groupownership_home_directories_dirs"/>
    <unix:state state_ref="state_file_groupownership_home_directories_gids"/>
  </unix:file_test>

</def-group>
