<def-group>
  <definition class="compliance" id="no_files_unowned_by_user" version="1">
    {{{ oval_metadata("All files should be owned by a user") }}}
    <criteria>
      <criterion comment="Check all files and make sure they are owned by a user" test_ref="no_files_unowned_by_user_test" />
    </criteria>
  </definition>

  <unix:file_state id="file_permissions_unowned_userid_list_match" version="1">
    <unix:user_id var_check="at least one" var_ref="file_permissions_unowned_userid_list" datatype="int" />
  </unix:file_state>

  <local_variable id="file_permissions_unowned_userid_list" comment="List of valid user ids" datatype="int" version="1">
    <object_component item_field="user_id" object_ref="file_permissions_unowned_userid_list_object" />
  </local_variable>

  <unix:password_object id="file_permissions_unowned_userid_list_object" version="1">
    <unix:username datatype="string" operation="pattern match">.*</unix:username>
  </unix:password_object>

  <unix:file_object comment="all local files" id="file_permissions_unowned_object" version="1">
    <unix:behaviors recurse="directories" recurse_direction="down" recurse_file_system="local" />
    <unix:path>/</unix:path>
    <unix:filename operation="pattern match">.*</unix:filename>
    <filter action="exclude">file_permissions_unowned_userid_list_match</filter>
  </unix:file_object>
  
  <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
  check="all" check_existence="none_exist" comment="Check user ids on all files on the system"
  id="no_files_unowned_by_user_test" version="1">
    <unix:object object_ref="file_permissions_unowned_object" />
  </unix:file_test>
</def-group>
  
