<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="2">
    {{{ oval_metadata("Check each directory in root's path and make sure it is owned by root") }}}
    <criteria comment="Check that each directory in root's path is owned by root">
      <criterion comment="Check for directories not owned by root in root's path"
      test_ref="test_accounts_root_path_dirs_owned_by_root" />
    </criteria>
  </definition>

  <ind:environmentvariable58_object id="object_accounts_root_path_dirs_owned_by_root_pathenv" version="1">
    <ind:pid xsi:nil="true" datatype="int" />
    <ind:name>PATH</ind:name>
  </ind:environmentvariable58_object>

  <local_variable comment="Split the PATH on the : delimiter" datatype="string"
  id="var_accounts_root_path_dirs_owned_by_root" version="1">
    <split delimiter=":">
      <object_component item_field="value"
      object_ref="object_accounts_root_path_dirs_owned_by_root_pathenv" />
    </split>
  </local_variable>

  <unix:file_test check="all" check_existence="none_exist"
  comment="Check if there aren't directories in root's path not owned by root"
  id="test_accounts_root_path_dirs_owned_by_root" version="1">
    <unix:object object_ref="object_accounts_root_path_dirs_not_owned_by_root" />
  </unix:file_test>

  <unix:file_object comment="root's path directories not owned by root"
  id="object_accounts_root_path_dirs_not_owned_by_root" version="1">
    <unix:path var_ref="var_accounts_root_path_dirs_owned_by_root" var_check="at least one" />
    <unix:filename xsi:nil="true" />
    <filter action="include">state_accounts_root_path_dirs_not_owned_by_root</filter>
    <filter action="exclude">state_accounts_root_path_dirs_symlink</filter>
  </unix:file_object>

  <unix:file_state comment="directory not owned by root"
  id="state_accounts_root_path_dirs_not_owned_by_root" version="1">
    <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
  </unix:file_state>

  <unix:file_state comment="symbolic link"
  id="state_accounts_root_path_dirs_symlink" version="1">
    <unix:type operation="equals">symbolic link</unix:type>
  </unix:file_state>

</def-group>
