<def-group>
    <definition class="compliance" id="{{{ rule_id }}}" version="1">
        {{{ oval_metadata("Evaluates to true if all files with SUID set are owned by RPM packages.", rule_title=rule_title) }}}
        <criteria>
            <criterion test_ref="test_file_permissions_unauthorized_suid"
                comment="Check if all suid files present in the system are authorized"/>
        </criteria>
    </definition>

    <!-- Collect all suid files in the system. -->
    <unix:file_state id="state_file_permissions_unauthorized_suid_set" version="1">
        <unix:suid datatype="boolean">true</unix:suid>
    </unix:file_state>

    <unix:file_state id="state_file_permissions_unauthorized_suid_sysroot" version="1"
        comment="Used to filter out all files in the /sysroot directory">
        <unix:filepath operation="pattern match">^/sysroot/.*$</unix:filepath>
    </unix:file_state>

    {{%- set var_local_mount_points = "var_" ~ rule_id ~ "_local_mountpoints" -%}}
    {{{ create_local_mount_points_list(var_local_mount_points, rule_id=rule_id) }}}

    <!-- This file_object will only find files located in local and not special file systems. The
         recurse_file_system parameter is set to defined in order to make sure the probe doesn't
         leave the scope of that mount point. For example, when probing "/", the probe will ignore
         any child directory which is a mount point for any other partition. This will ensure
         considerable performance improvement. -->
    <unix:file_object id="object_file_permissions_unauthorized_suid_all_suid_files" version="1"
        comment="all files with suid set">
        <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1"
            recurse_file_system="defined"/>
            <unix:path operation="equals" var_check="at least one"
                var_ref="{{{ var_local_mount_points }}}"/>
        <unix:filename operation="pattern match">^.*$</unix:filename>
        <filter action="include">state_file_permissions_unauthorized_suid_set</filter>
        <filter action="exclude">state_file_permissions_unauthorized_suid_sysroot</filter>
    </unix:file_object>

    <local_variable id="var_file_permissions_unauthorized_suid_all_suid_files" version="1"
        datatype="string" comment="all files with suid set">
        <object_component item_field="filepath"
            object_ref="object_file_permissions_unauthorized_suid_all_suid_files"/>
    </local_variable>

    <!-- Locate all rpm packages including located system suid files. -->
    <linux:rpmverifyfile_object id="object_file_permissions_unauthorized_suid_rpms" version="1"
        comment="all files with suid set that come from a RPM package">
        <linux:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true"
            nomtime="true" nomode="true" nordev="true"/>
        <linux:name operation="pattern match">.*</linux:name>
        <linux:epoch operation="pattern match">.*</linux:epoch>
        <linux:version operation="pattern match">.*</linux:version>
        <linux:release operation="pattern match">.*</linux:release>
        <linux:arch operation="pattern match">.*</linux:arch>
        <linux:filepath operation="equals" var_check="all"
            var_ref="var_file_permissions_unauthorized_suid_all_suid_files"/>
    </linux:rpmverifyfile_object>

    <!-- Extract the filepaths of rpm packages containing system suid files. -->
    <local_variable id="var_file_permissions_unauthorized_suid_rpms" version="1"
        datatype="string" comment="all files with suid set that are managed by a RPM package">
        <object_component item_field="filepath"
            object_ref="object_file_permissions_unauthorized_suid_rpms"/>
    </local_variable>

    <!-- Convert the local variable to a variable state which will be used below as a filter. -->
    <ind:variable_state id="state_file_permissions_unauthorized_suid_rpm_filepaths" version="1">
        <ind:value datatype="string" operation="equals" var_check="at least one"
            var_ref="var_file_permissions_unauthorized_suid_rpms"/>
    </ind:variable_state>

    <!-- Variable object containing only system suid files not include in rpm packages. -->
    <ind:variable_object id="object_file_permissions_unauthorized_suid_no_rpm_files" version="1">
        <ind:var_ref>var_file_permissions_unauthorized_suid_all_suid_files</ind:var_ref>
        <filter action="exclude">state_file_permissions_unauthorized_suid_rpm_filepaths</filter>
    </ind:variable_object>

    <ind:variable_test id="test_file_permissions_unauthorized_suid" version="1"
        check="all" check_existence="none_exist"
        comment="Check the existence of suid files not included in rpm packages.">
        <ind:object object_ref="object_file_permissions_unauthorized_suid_no_rpm_files"/>
    </ind:variable_test>
</def-group>
