<def-group>
     <definition class="compliance" id="{{{ rule_id }}}" version="1">
     {{{ oval_metadata("Check that sudoers doesn't contain command negations") }}}
     <criteria operator="AND">
	     <criterion comment="Make sure that no command in user spec contains negation" test_ref="test_{{{ rule_id }}}" />
     </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="none_exist"
  comment="Make sure that no command in user spec contains negation"
	  id="test_{{{ rule_id }}}" version="1">
  <ind:object object_ref="object_{{{ rule_id }}}" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_{{{ rule_id }}}" version="1">
    <ind:filepath operation="pattern match">^/etc/sudoers(\.d/.*)?$</ind:filepath>
    <!-- The regex idea: <user list> <host list> = (<the whole command without negation>,)* <command with negation> <whatever>
         where a command is <runas spec>?<anything except , or !>+,
           - ',' is a command delimiter, while
           - '!' as the leading character outside of a runas spec is a command negation we are after,
         The last non-capturing group holds the offending command.
    -->
    <ind:pattern operation="pattern match">^(?:\s*[^#=]+)=(?:\s*(?:\([^\)]+\))?\s*(?!\s*\()[^,!\n][^,\n]+,)*\s*(?:\([^\)]+\))?\s*(?!\s*\()(!\S+).*</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
