<def-group>
  <definition class="compliance" id="{{{ _RULE_ID }}}" version="1">
   {{% if FILEPATH is not string %}}
      {{{ oval_metadata("This test makes sure that " + FILEPATH|join(", ") + " is group owned by " + GID_OR_NAME|replace("|", " or ") + ".", rule_title=rule_title) }}}
      <criteria>
    {{% for filepath in FILEPATH %}}
      <criterion comment="Check file group ownership of {{{ filepath }}}" test_ref="test_file_groupowner{{{ FILEID }}}_{{{ loop.index0 }}}" />
    {{% endfor %}}
   {{% else %}}
    {{{ oval_metadata("This test makes sure that " + FILEPATH + " is group owned by " + GID_OR_NAME|replace("|", " or ") + ".", rule_title=rule_title) }}}
    <criteria>
      <criterion comment="Check file group ownership of {{{ FILEPATH }}}" test_ref="test_file_groupowner{{{ FILEID }}}" />
   {{% endif %}}
    </criteria>
  </definition>

  {{%- set GROUPS=GID_OR_NAME.split("|") %}}
  {{%- if GROUP_REPRESENTED_WITH_GID %}}
    <local_variable id="var_file_groupowner{{{ FILEID }}}_{{{ GID_OR_NAME }}}_gid" comment="Set the gid to {{{ GID_OR_NAME }}}" datatype="int" version="1">
      <literal_component datatype="int">{{{ GID_OR_NAME }}}</literal_component>
    </local_variable>
  {{%- else %}}
    {{% for grp in GROUPS %}}

      <ind:textfilecontent54_object id="object_file_groupowner{{{ FILEID }}}_{{{grp}}}_gid_etc" version="1" comment="gid of the {{{grp}}} group (from /etc/group)">
        <ind:filepath>/etc/group</ind:filepath>
        <ind:pattern operation="pattern match">^{{{grp}}}:\w+:(\w+):.*</ind:pattern>
        <ind:instance datatype="int" operation="equals">1</ind:instance>
      </ind:textfilecontent54_object>

      <ind:textfilecontent54_object id="object_file_groupowner{{{ FILEID }}}_{{{grp}}}_gid_usr" version="1" comment="gid of the {{{grp}}} group (from /usr/lib/group)">
        <ind:filepath>/usr/lib/group</ind:filepath>
        <ind:pattern operation="pattern match">^{{{grp}}}:\w+:(\w+):.*</ind:pattern>
        <ind:instance datatype="int" operation="equals">1</ind:instance>
      </ind:textfilecontent54_object>

  <ind:textfilecontent54_object id="object_file_groupowner{{{ FILEID }}}_{{{grp}}}_gid" version="1" comment="gid of the {{{grp}}} group (from /etc/group or /usr/lib/group)">
    <set>
      <object_reference>object_file_groupowner{{{ FILEID }}}_{{{grp}}}_gid_etc</object_reference>
      <object_reference>object_file_groupowner{{{ FILEID }}}_{{{grp}}}_gid_usr</object_reference>
    </set>
  </ind:textfilecontent54_object>

      <local_variable id="var_file_groupowner{{{ FILEID }}}_{{{grp}}}_gid" datatype="int" version="1" comment="Retrieve the gid of {{{grp}}} from either /etc/group or /usr/lib/group">
        <object_component item_field="subexpression" object_ref="object_file_groupowner{{{ FILEID }}}_{{{grp}}}_gid"/>
      </local_variable>
    {{% endfor %}}
  {{%- endif %}}

  {{% for filepath in FILEPATH %}}
    <unix:file_test check="all" check_existence="none_exist" comment="Testing group ownership of {{{ filepath }}}" id="test_file_groupowner{{{ FILEID }}}_{{{ loop.index0 }}}" version="1">
      <unix:object object_ref="object_file_groupowner{{{ FILEID }}}_{{{ loop.index0 }}}" />
    </unix:file_test>

    <unix:file_object comment="{{{ filepath }}}" id="object_file_groupowner{{{ FILEID }}}_{{{ loop.index0 }}}" version="1">
      {{%- if IS_DIRECTORY -%}}
        {{%- if RECURSIVE %}}
          <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
        {{%- endif %}}
        <unix:path>{{{ filepath[:-1] }}}</unix:path>
        {{%- if FILE_REGEX %}}
          <unix:filename operation="pattern match">{{{ FILE_REGEX[loop.index0] }}}</unix:filename>
        {{%- else %}}
          <unix:filename xsi:nil="true" />
        {{%- endif %}}
      {{%- else %}}
        <unix:filepath{{% if FILEPATH_IS_REGEX %}} operation="pattern match"{{% endif %}}>{{{ filepath }}}</unix:filepath>
      {{%- endif %}}
      <filter action="exclude">symlink_file_groupowner</filter>
      {{% for grp in GROUPS %}}
      <filter action="exclude">state_file_groupowner{{{ FILEID }}}_{{{ loop.index0 }}}_{{{ grp }}}</filter>
      {{% endfor %}}
    </unix:file_object>

    {{% for grp in GROUPS %}}
      <unix:file_state id="state_file_groupowner{{{ FILEID }}}_{{{ loop.index0 }}}_{{{ grp }}}" version="1">
        <unix:group_id datatype="int" operation="equals" var_ref="var_file_groupowner{{{ FILEID }}}_{{{grp}}}_gid"></unix:group_id>
      </unix:file_state>
    {{% endfor %}}
  {{% endfor %}}
    <unix:file_state id="symlink_file_groupowner" version="1">
      <unix:type operation="equals">symbolic link</unix:type>
    </unix:file_state>
</def-group>
