<def-group>
  <definition class="compliance" id="gid_passwd_group_same" version="2">
    {{{ oval_metadata("All GIDs referenced in /etc/passwd must be defined in /etc/group.") }}}
    <criteria>
      <criterion test_ref="test_gid_passwd_group_same" />
    </criteria>
  </definition>

  <!-- OVAL object to collect content of /etc/group file -->
  <ind:textfilecontent54_object id="object_gid_passwd_group_same_var" version="1">
    <ind:filepath>/etc/group</ind:filepath>
    <!-- Group ID (GID) from /etc/group (3-rd column) captured as subexpression of this object -->
    <ind:pattern operation="pattern match">^[^:]+:[^:]+:([0-9]+):</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <!-- OVAL variable to hold all the different GIDs from /etc/group -->
  <local_variable id="var_gid_passwd_group_same" comment="GIDs from /etc/group" datatype="string" version="1">
    <object_component item_field="subexpression" object_ref="object_gid_passwd_group_same_var" />
  </local_variable>

  <!-- Verify that all GIDs used in /etc/passwd are also defined in /etc/group -->
  <ind:textfilecontent54_test id="test_gid_passwd_group_same" check="all" check_existence="all_exist"
  comment="Verify all GIDs referenced in /etc/passwd are defined in /etc/group" version="1">
    <ind:object object_ref="object_gid_passwd_group_same" />
    <ind:state state_ref="state_gid_passwd_group_same" />
  </ind:textfilecontent54_test>

  <!-- OVAL object to collect content of /etc/passwd file -->
  <ind:textfilecontent54_object id="object_gid_passwd_group_same" version="1">
    <ind:filepath>/etc/passwd</ind:filepath>
    <!-- Group ID (GID) from /etc/passwd (4-th column) captured as subexpression of this object -->
    <ind:pattern operation="pattern match">^[^:]+:[^:]+:[0-9]+:([0-9]+):</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <!-- OVAL state to check if all GIDs used in /etc/passwd are also defined in /etc/group -->
  <ind:textfilecontent54_state id="state_gid_passwd_group_same" version="1">
    <ind:subexpression operation="equals" var_ref="var_gid_passwd_group_same" var_check="at least one" datatype="string" />
  </ind:textfilecontent54_state>

</def-group>
