<def-group>
  <definition class="compliance" id="file_groupownership_system_commands_dirs" version="1">
    {{{ oval_metadata("
        Checks that system commands in /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin 
        are owned by system group.
      ", rule_title=rule_title) }}}
    <criteria >
      <criterion test_ref="test_groupownership_system_commands_dirs" />
    </criteria>
  </definition>

  <unix:file_test  check="all" check_existence="none_exist" comment="system commands are owned by root" id="test_groupownership_system_commands_dirs" version="1">
    <unix:object object_ref="object_groupownership_system_commands_dirs" />
  </unix:file_test>

  <unix:file_object comment="system commands files" id="object_groupownership_system_commands_dirs" version="1">
    <!-- Check that system commands within directories /bin /sbin /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin 
         belong to system group -->
    <unix:path operation="pattern match">^\/s?bin|^\/usr\/s?bin|^\/usr\/local\/s?bin</unix:path>
    <unix:filename operation="pattern match">^.*$</unix:filename>
   <filter action="include">state_groupowner_system_commands_dirs_not_system_group_not_sgid</filter>
   <filter action="exclude">state_groupowner_system_commands_dirs_symlink</filter>
  </unix:file_object>

  <unix:file_state id="state_groupowner_system_commands_dirs_not_system_group_not_sgid" version="1">
    <unix:group_id datatype="int" operation="greater than or equal">{{{ gid_min }}}</unix:group_id>
    <unix:sgid datatype="boolean">false</unix:sgid>
    {{% if product in ['ubuntu2404'] %}}
    <unix:uexec datatype="boolean">true</unix:uexec>
    {{% endif %}}
  </unix:file_state>

  <unix:file_state comment="symbolic link" id="state_groupowner_system_commands_dirs_symlink" version="1">
    <unix:type operation="equals">symbolic link</unix:type>
  </unix:file_state>

</def-group>
