<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group") }}}
    <criteria>
      <criterion test_ref="test_accounts_users_home_files_groupownership"
                 comment="All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group"/>
    </criteria>
  </definition>

  {{%- set interactive_users_home_dirs_object = "object_" ~ rule_id ~ "_home_dirs" -%}}
  {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_home_dirs_object) }}}
  {{%- set interactive_users_gids_object = "object_" ~ rule_id ~ "_gids" -%}}
  {{{ create_local_interactive_users_gids_list_object(interactive_users_gids_object) }}}

  <local_variable id="var_accounts_users_home_files_groupownership_dirs" datatype="string" version="1"
                  comment="Variable including all home dirs from interactive users">
    <object_component item_field="subexpression"
                      object_ref="{{{ interactive_users_home_dirs_object }}}"/>
  </local_variable>

  <local_variable id="var_accounts_users_home_files_groupownership_gids" datatype="int" version="1"
                  comment="List of interactive users gids">
    <object_component item_field="subexpression"
                      object_ref="{{{ interactive_users_gids_object }}}"/>
  </local_variable>

  <!-- #### creation of object #### -->
  <unix:file_object id="object_accounts_users_home_files_groupownership_dirs" version="1">
    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1"
                    recurse_file_system="local"/>
    <unix:path var_ref="var_accounts_users_home_files_groupownership_dirs" var_check="at least one"/>
    <unix:filename operation="pattern match">.*</unix:filename>
  </unix:file_object>

  <!-- #### creation of state #### -->
  <unix:file_state id="state_accounts_users_home_files_groupownership_gids" version="1">
    <unix:group_id datatype="int" var_check="only one"
                  var_ref="var_accounts_users_home_files_groupownership_gids"/>
  </unix:file_state>

  <!-- #### creation of test #### -->
  <unix:file_test id="test_accounts_users_home_files_groupownership" check="all"
                  check_existence="any_exist" version="1"
                  comment="All home directories files are group-owned by a local interactive user">
    <unix:object object_ref="object_accounts_users_home_files_groupownership_dirs"/>
    <unix:state state_ref="state_accounts_users_home_files_groupownership_gids"/>
  </unix:file_test>
</def-group>
