<def-group>
  <definition class="compliance" id="no_forward_files" version="1">
    {{{ oval_metadata("The .forward file specifies an email address to forward the user's mail to. Any .forward files should be removed.", rule_title=rule_title) }}}
    <criteria>
      <criterion test_ref="test_accounts_users_home_forward_file_existance" negate="true" />
    </criteria>
  </definition>

  {{%- set interactive_users_object = "object_" ~ rule_id ~ "_objects" -%}}
  {{{ create_interactive_users_list_object(interactive_users_object, rule_id=rule_id) }}}

  <local_variable id="var_accounts_users_home_forward_file_existance_dirs" datatype="string" version="1"
                  comment="Variable including all home dirs from interactive users">
    <object_component item_field="home_dir"
                      object_ref="{{{ interactive_users_object }}}"/>
  </local_variable>

  <unix:file_object id="object_accounts_users_home_forward_file_existance" version="1">
    <unix:path var_ref="var_accounts_users_home_forward_file_existance_dirs" var_check="at least one"/>
    <unix:filename operation="pattern match">\.forward$</unix:filename>
  </unix:file_object>

  <unix:file_test id="test_accounts_users_home_forward_file_existance" check="all"
                  check_existence="at_least_one_exists" version="1"
                  comment=".forward files are not group or world accessible">
    <unix:object object_ref="object_accounts_users_home_forward_file_existance"/>
  </unix:file_test>
</def-group>
