<def-group>
  <definition class="compliance" id="grub2_admin_username" version="1">
    {{{ oval_metadata(
              "The grub2 boot loader superuser should have a username that is hard to guess.", rule_title=rule_title) }}}

    <criteria operator="OR">
      <criterion comment="Superuser is defined in {{{ grub2_boot_path }}}/grub.cfg and it isn't
            root, admin, administrator nor equal to any system username"
            test_ref="test_bootloader_superuser_differ_from_other_users"/>
    </criteria>
  </definition>

  <unix:password_object id="object_user_accounts" version="1">
    <unix:username datatype="string" operation="pattern match">.*</unix:username>
  </unix:password_object>

  <local_variable id="var_user_accounts" datatype="string" version="1" comment="Variable
          including all system usernames">
    <object_component item_field="username" object_ref="object_user_accounts"/>
  </local_variable>

  <ind:textfilecontent54_state id="state_bootloader_superuser_differ_from_other_users" 
          version="1">
    <ind:subexpression datatype="string" operation="not equal" var_check="all"
          var_ref="var_user_accounts" />
  </ind:textfilecontent54_state>

  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="superuser
          is defined in {{{ grub2_boot_path }}}/grub.cfg. Superuser is not
          equal to other system account nor root, admin, administrator"
          id="test_bootloader_superuser_differ_from_other_users" version="1">
    <ind:object object_ref="object_bootloader_unique_superuser" />
    <ind:state state_ref="state_bootloader_superuser_differ_from_other_users" />
  </ind:textfilecontent54_test>

  <ind:textfilecontent54_object id="object_bootloader_unique_superuser" version="1">
    <ind:filepath>{{{ grub2_boot_path }}}/grub.cfg</ind:filepath>
    <ind:pattern operation="pattern match"
          >^[\s]*set[\s]+superusers="(?i)\b(?!(?:root|admin|administrator)\b)(\w+)".*\n[\s]*export[\s]+superusers[\s]*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
</def-group>
