<def-group>
    <definition class="compliance" id="{{{ rule_id }}}" version="1">
        {{{ oval_metadata("User initialization files have mode 0740 or less permissive") }}}
        <criteria>
            <criterion comment="Initialization files have mode 0740 or less permissive"
                test_ref="test_{{{ rule_id }}}" />
        </criteria>
    </definition>

    <unix:file_test id="test_{{{ rule_id }}}" check="all"
                    check_existence="any_exist" version="1"
                    comment="Init files have mode 0740 or less permissive">
        <unix:object object_ref="object_{{{ rule_id }}}"/>
        <unix:state state_ref="state_{{{ rule_id }}}"/>
    </unix:file_test>

    <unix:file_object id="object_{{{ rule_id }}}" version="1">
        <unix:path var_ref="var_{{{ rule_id }}}_home_dirs" var_check="at least one"/>
        <unix:filename operation="pattern match" var_ref="var_user_initialization_files_regex"/>
    </unix:file_object>


    <unix:file_state id="state_{{{ rule_id }}}" operator="AND" version="1">
        <unix:suid datatype="boolean">false</unix:suid>
        <unix:sgid datatype="boolean">false</unix:sgid>
        <unix:sticky datatype="boolean">false</unix:sticky>
        <unix:gwrite datatype="boolean">false</unix:gwrite>
        <unix:gexec datatype="boolean">false</unix:gexec>
        <unix:oread datatype="boolean">false</unix:oread>
        <unix:owrite datatype="boolean">false</unix:owrite>
        <unix:oexec datatype="boolean">false</unix:oexec>
    </unix:file_state>


    {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}}
    {{{ create_interactive_users_list_object(interactive_users_object) }}}

    <local_variable id="var_{{{ rule_id }}}_home_dirs" datatype="string" version="1"
                    comment="Variable including all home dirs from interactive users">
        <object_component item_field="home_dir"
                        object_ref="{{{ interactive_users_object }}}"/>
    </local_variable>
    

    <external_variable comment="init files regex" datatype="int"
        id="var_user_initialization_files_regex" version="1" />
</def-group>
