<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
    {{{ oval_metadata("All Interactive User Home Directories Must Have mode 0750 Or Less Permissive", rule_title=rule_title) }}}
    <criteria>
      <criterion test_ref="test_file_permissions_home_directories"
                 comment="All interactive user's Home Directories must have proper permissions"/>
    </criteria>
  </definition>

  {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}}
  {{{ create_local_interactive_users_home_dirs_list_object(interactive_users_object) }}}

  <!-- #### prepare for test_file_permissions_home_directories #### -->
  <local_variable id="var_file_permissions_home_directories_dirs" datatype="string" version="1"
                  comment="Variable including all home dirs from interactive users">
    <object_component item_field="subexpression" object_ref="{{{ interactive_users_object }}}"/>
  </local_variable>

  <!-- #### creation of object #### -->
  <unix:file_object id="object_file_permissions_home_directories_dirs" version="1">
    <unix:path var_ref="var_file_permissions_home_directories_dirs" var_check="at least one"/>
    <unix:filename xsi:nil="true"/>
  </unix:file_object>

  <!-- #### creation of state #### -->
  <unix:file_state id="state_file_permissions_home_directories_dirs" version="1" operator='AND'>
    <unix:type operation="equals">directory</unix:type>
    <unix:suid datatype="boolean">false</unix:suid>
    <unix:sgid datatype="boolean">false</unix:sgid>
    <unix:sticky datatype="boolean">false</unix:sticky>
    <unix:gwrite datatype="boolean">false</unix:gwrite>
    <unix:oread datatype="boolean">false</unix:oread>
    <unix:owrite datatype="boolean">false</unix:owrite>
    <unix:oexec datatype="boolean">false</unix:oexec>
  </unix:file_state>

  <!-- #### creation of test #### -->
  <unix:file_test id="test_file_permissions_home_directories" check="all" check_existence="any_exist"
                  version="1" comment="All home directories have proper permissions">
    <unix:object object_ref="object_file_permissions_home_directories_dirs"/>
    <unix:state state_ref="state_file_permissions_home_directories_dirs"/>
  </unix:file_test>
</def-group>
