<def-group>
  <definition class="compliance" id="dir_system_commands_group_root_owned" version="1">
    {{{ oval_metadata("
        Checks that directories /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin
        have root as a group owner
      ") }}}
    <criteria >
      <criterion test_ref="test_group_ownership_system_commands_dirs" />
    </criteria>
  </definition>

  <unix:file_test  check="all" check_existence="none_exist" comment="system commands directories uid root" id="test_group_ownership_system_commands_dirs" version="1">
    <unix:object object_ref="object_system_commands_dirs_group_ownership" />
  </unix:file_test>

  <unix:file_object comment="system commands directories" id="object_system_commands_dirs_group_ownership" version="1">
    <!-- Check that bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin directories belong to user with uid 0 (root) -->
    <unix:path operation="pattern match">^\/s?bin|^\/usr\/s?bin|^\/usr\/local\/s?bin</unix:path>
    <unix:filename xsi:nil="true" />
    <filter action="include">state_system_commands_dirs_group_owner_not_root</filter>
  </unix:file_object>

  <unix:file_state id="state_system_commands_dirs_group_owner_not_root" version="1">
    <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
  </unix:file_state>

</def-group>
