<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("User Initialization Files Must Be Owned By the Primary User") }}}
    <criteria>
      <criterion test_ref="test_accounts_user_dot_user_ownership"
                 comment="User Initialization Files Must Be Owned By the Primary User"/>
    </criteria>
  </definition>

  <unix:password_object id="object_accounts_user_dot_user_ownership_objects" version="1">
    <unix:username datatype="string" operation="not equal">nobody</unix:username>
    <filter action="include">state_accounts_user_dot_user_ownership_interactive_uids</filter>
  </unix:password_object>

  <unix:password_state id="state_accounts_user_dot_user_ownership_interactive_uids" version="1">
    <unix:user_id datatype="int" operation="greater than or equal">{{{ uid_min }}}</unix:user_id>
  </unix:password_state>

  <local_variable id="var_accounts_user_dot_user_ownership_dirs" datatype="string" version="1"
                  comment="Variable including all home dirs from interactive users">
    <object_component item_field="home_dir"
                      object_ref="object_accounts_user_dot_user_ownership_objects"/>
  </local_variable>

  <local_variable id="var_accounts_user_dot_user_ownership_uids" datatype="int" version="1"
                  comment="List of interactive users uids">
    <object_component item_field="user_id"
                      object_ref="object_accounts_user_dot_user_ownership_objects"/>
  </local_variable>

  <!-- #### creation of object #### -->
  <unix:file_object id="object_accounts_user_dot_user_ownership_init_files" version="1">
    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1"
                    recurse_file_system="local"/>
    <unix:path var_ref="var_accounts_user_dot_user_ownership_dirs" var_check="at least one"/>
    <unix:filename operation="pattern match">^\..*</unix:filename>
  </unix:file_object>

  <!-- #### creation of state #### -->
  <unix:file_state id="state_accounts_user_dot_user_ownership_uids" version="1">
    <unix:user_id datatype="int" var_check="only one"
                  var_ref="var_accounts_user_dot_user_ownership_uids"/>
  </unix:file_state>

  <!-- #### creation of test #### -->
  <unix:file_test id="test_accounts_user_dot_user_ownership" check="all"
                  check_existence="any_exist" version="1"
                  comment="All user initialization files are owned by a local interactive user">
    <unix:object object_ref="object_accounts_user_dot_user_ownership_init_files"/>
    <unix:state state_ref="state_accounts_user_dot_user_ownership_uids"/>
  </unix:file_test>
</def-group>
