<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("Ensure shadow group is empty") }}}
    <criteria>
      <criterion test_ref="tst_shadow_group_empty" comment="shadow group is empty" />
      <criterion test_ref="tst_no_user_assigned_shadow_group"
          comment="no user has the shadow as primary group" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="any_exist"
      id="tst_shadow_group_empty" version="1" comment="shadow group is empty">
    <ind:object object_ref="obj_shadow_group_members" />
    <ind:state state_ref="ste_shadow_group_members" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_shadow_group_members" version="1">
    <ind:filepath datatype="string">/etc/group</ind:filepath>
    <ind:pattern operation="pattern match" datatype="string">^shadow:.*:.*:(.*)$</ind:pattern>
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="ste_shadow_group_members" version="1">
      <ind:subexpression operation="pattern match">^\s*$</ind:subexpression>
  </ind:textfilecontent54_state>

  <local_variable id="var_shadow_gid" datatype="string"
      comment="regex with shadow group id" version="1">
      <concat>
          <literal_component>^.*:.*:.*:</literal_component>
          <regex_capture pattern="^shadow:.*:(.*):.*$">
              <object_component object_ref="obj_shadow_group_members" item_field="text"  />
          </regex_capture>
          <literal_component>:.*:.*:.*$</literal_component>
      </concat>
  </local_variable>

  <ind:textfilecontent54_test check="all" check_existence="none_exist"
      id="tst_no_user_assigned_shadow_group" version="1"
      comment="no user is assigned to the shadow group">
    <ind:object object_ref="obj_etc_passwd_user_has_shadow_group" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="obj_etc_passwd_user_has_shadow_group" version="1">
    <ind:filepath datatype="string">/etc/passwd</ind:filepath>
    <ind:pattern operation="pattern match" var_ref="var_shadow_gid" />
    <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
