<def-group>
  <definition class="compliance" id="dconf_gnome_disable_user_admin" version="1">
    <metadata>
        <title>Disable User Administration in GNOME3</title>
        
    <affected family="unix">
    <platform>Ubuntu 22.04</platform>
    </affected>
        <description>Ensure 'user-administration-disabled' is configured with value 'true in section 'org/gnome/desktop/lockdown' in /etc/dconf/db/local.d/</description>
    </metadata>
    <criteria comment="dconf is configured correctly"
    operator="AND"><criterion comment="Check the user-administration-disabled in /etc/dconf/db/local.d/"
  test_ref="test_dconf_gnome_disable_user_admin" />
      <criterion comment="Prevent user from modifying user-administration-disabled"
      test_ref="test_prevent_user_user-administration-disabled" />
    </criteria>
  </definition>
  
<ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="tests the value of user-administration-disabled setting in the /etc/dconf/db/local.d/ file"
  id="test_dconf_gnome_disable_user_admin" version="1">
  <ind:object object_ref="obj_dconf_gnome_disable_user_admin" />
  <ind:state state_ref="state_dconf_gnome_disable_user_admin" />
</ind:textfilecontent54_test>
  
<ind:textfilecontent54_object id="obj_dconf_gnome_disable_user_admin" version="1">
  <ind:path>/etc/dconf/db/local.d/</ind:path>
  <ind:filename operation="pattern match">^.*$</ind:filename>
  <ind:pattern operation="pattern match">^\s*\[org/gnome/desktop/lockdown\].*(?:\n\s*[^[\s].*)*\n^\s*user-administration-disabled[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#)</ind:pattern>
  <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
  
<ind:textfilecontent54_state id="state_dconf_gnome_disable_user_admin" version="1">
  <ind:subexpression datatype="string" operation="pattern match">^true$</ind:subexpression>
</ind:textfilecontent54_state>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="Prevent user from modifying user-administration-disabled"
  id="test_prevent_user_user-administration-disabled" version="1">
    <ind:object object_ref="obj_prevent_user_user-administration-disabled" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_prevent_user_user-administration-disabled"
  version="1">
    <ind:path>/etc/dconf/db/local.d/locks</ind:path>
    <ind:filename operation="pattern match">^.*$</ind:filename>
    <ind:pattern operation="pattern match">^/org/gnome/desktop/lockdown/user-administration-disabled$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

</def-group>