<def-group>
    <definition id="file_permissions_unauthorized_sgid" version="1" class="compliance">
        {{{ oval_metadata("Evaluates to true if all files with SGID set are owned by RPM packages.") }}}
        <criteria>
            <criterion comment="Check all sgid files" test_ref="test_file_permissions_unauthorized_sgid"/>
        </criteria>
    </definition>

    <unix:file_test check="all" check_existence="none_exist" comment="sgid files outside system RPMs" id="test_file_permissions_unauthorized_sgid" version="1">
        <unix:object object_ref="obj_file_permissions_unauthorized_sgid_unowned" />
    </unix:file_test>

    <unix:file_object comment="files with sgid set which are not owned by any RPM package" id="obj_file_permissions_unauthorized_sgid_unowned" version="1">
        <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
        <unix:path operation="equals">/</unix:path>
        <unix:filename operation="pattern match">^.*$</unix:filename>
        <filter action="include">state_file_permissions_unauthorized_sgid_sgid_set</filter>
        <filter action="exclude">state_file_permissions_unauthorized_sgid_filepaths</filter>
    </unix:file_object>

    <linux:rpmverifyfile_object id="obj_file_permissions_unauthorized_sgid_rpms" version="1" comment="all files with sgid set that come from a RPM package">
        <linux:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true" />
        <linux:name operation="pattern match">.*</linux:name>
        <linux:epoch operation="pattern match">.*</linux:epoch>
        <linux:version operation="pattern match">.*</linux:version>
        <linux:release operation="pattern match">.*</linux:release>
        <linux:arch operation="pattern match">.*</linux:arch>
        <linux:filepath var_ref="var_file_permissions_unauthorized_sgid_all" operation="equals" var_check="all" />
    </linux:rpmverifyfile_object>

    <unix:file_object comment="all files with sgid set" id="obj_file_permissions_unauthorized_sgid_files" version="1">
        <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
        <unix:path operation="equals">/</unix:path>
        <unix:filename operation="pattern match">^.*$</unix:filename>
        <filter action="include">state_file_permissions_unauthorized_sgid_sgid_set</filter>
    </unix:file_object>

    <unix:file_state id="state_file_permissions_unauthorized_sgid_sgid_set" version="1">
        <unix:sgid datatype="boolean">true</unix:sgid>
    </unix:file_state>

    <unix:file_state id="state_file_permissions_unauthorized_sgid_filepaths" version="1">
        <unix:filepath var_ref="var_file_permissions_unauthorized_sgid_rpms" var_check="at least one" />
    </unix:file_state>

    <local_variable id="var_file_permissions_unauthorized_sgid_rpms" datatype="string" version="1" comment="all files with sgid set that come from a RPM package">
        <object_component item_field="filepath" object_ref="obj_file_permissions_unauthorized_sgid_rpms" />
    </local_variable>

    <local_variable id="var_file_permissions_unauthorized_sgid_all" datatype="string" version="1" comment="all files with sgid set">
        <object_component item_field="filepath" object_ref="obj_file_permissions_unauthorized_sgid_files" />
    </local_variable>
</def-group>
