<def-group>
  <definition class="compliance" id="accounts_authorized_local_users" version="1">
    {{{ oval_metadata("Besides the default operating system user, there should be no other users
      except the users that are authorized to exist locally on the operating system.", rule_title=rule_title) }}}
    <criteria>
      <criterion test_ref="test_accounts_authorized_local_users"
      comment="only root user and explicitly authorized users are allowed in /etc/passwd" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test id="test_accounts_authorized_local_users" version="1"
  check_existence="any_exist" check="all" comment="query /etc/passwd">
    <ind:object object_ref="object_accounts_authorized_local_users" />
    <ind:state state_ref="state_accounts_authorized_local_users" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_accounts_authorized_local_users" version="1">
    <ind:filepath>/etc/passwd</ind:filepath>
    <ind:pattern operation="pattern match">^([a-zA-Z0-9_.-]+?):</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
    <filter action="exclude">state_default_os_user</filter>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state id="state_default_os_user" version="1"
  comment="The user root is always allowed as default opering system user" >
    <ind:subexpression operation="pattern match">^root$</ind:subexpression>
  </ind:textfilecontent54_state>

  <ind:textfilecontent54_state id="state_accounts_authorized_local_users" version="1"
  comment="authorized usernames required by the installed software groups and applications" >
    <ind:subexpression operation="pattern match"
    var_ref="var_accounts_authorized_local_users_regex"></ind:subexpression>
  </ind:textfilecontent54_state>

  <external_variable id="var_accounts_authorized_local_users_regex" version="1" datatype="string"
  comment="accounts authorized local users on operating system"/>
</def-group>
