<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
      {{{ oval_metadata("Owner of /var/log/* should be root or syslog.", rule_title=rule_title) }}}
    <criteria comment="Check file ownership of /var/log/*">
     <criterion test_ref="test_file_ownership_var_log" />
    </criteria>
  </definition>

  <ind:textfilecontent54_object id="{{{ rule_id }}}_object_syslog_uid" version="1" comment="uid of the dedicated syslog group">
    <ind:filepath>/etc/passwd</ind:filepath>
    <ind:pattern operation="pattern match">^syslog:[^:]+:([0-9]+):</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>
  <local_variable id="{{{ rule_id }}}_var_syslog_uid" comment="Retrieve the uid of syslog" datatype="int" version="1">
    <object_component item_field="subexpression" object_ref="{{{ rule_id }}}_object_syslog_uid" />
  </local_variable>

  <unix:file_test check_existence="any_exist" check="all" comment="/var/log/* owner is root|syslog"
      id="test_file_ownership_var_log" state_operator="OR" version="1">
    <unix:object object_ref="object_file_ownership_var_log" />
    <unix:state state_ref="state_file_ownership_syslog_var_log_auth_log"/>
    <unix:state state_ref="state_file_ownership_root_var_log_auth_log"/>
    {{%- if product == "ubuntu2204" %}}
    <unix:state state_ref="{{{ rule_id }}}_system_files_with_empty_group"/>
    {{%- endif %}}
  </unix:file_test>
  <unix:file_object comment="/var/log/*" id="object_file_ownership_var_log" version="1">
    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
    <unix:path>/var/log</unix:path>
    <unix:filename operation="pattern match">.*</unix:filename>
    <filter action="exclude">{{{ rule_id }}}_exclude_symlinks</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_apt</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_auth_log</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_bwtmp</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_cloudinit</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_gdm</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_journal</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_landscape</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_lastlog</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_localmessages</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_messages</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_secure</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_sssd</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_syslog</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_waagent</filter>
    {{% if 'debian' in product %}}
    <!-- Exim and aide uses their own system user -->
    <filter action="exclude">{{{ rule_id }}}_exclude_files_aide</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_exim</filter>
    {{% endif %}}
  </unix:file_object>
  <unix:file_state id="{{{ rule_id }}}_exclude_symlinks" version="1">
    <unix:type operation="equals">symbolic link</unix:type>
  </unix:file_state>
  <unix:file_state id="state_file_ownership_syslog_var_log_auth_log" version="1">
    <unix:user_id datatype="int" operation="equals" var_ref="{{{ rule_id }}}_var_syslog_uid"/>
  </unix:file_state>
  <unix:file_state id="state_file_ownership_root_var_log_auth_log" version="1">
    <unix:user_id datatype="int" operation="equals">0</unix:user_id>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_apt" version="1">
    <unix:filepath operation="pattern match">^/var/log/apt/.*</unix:filepath>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_landscape" version="1">
    <unix:filepath operation="pattern match">^/var/log/landscape/.*</unix:filepath>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_auth_log" version="1">
    <unix:filename>auth.log</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_bwtmp" version="1">
    <unix:filename operation="pattern match">^[bw]tmp((\.|-).*)?$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_cloudinit" version="1">
    <unix:filename operation="pattern match">^cloud-init\.log.*</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_gdm" version="1" operator="AND">
    <unix:filepath operation="pattern match">^/var/log/(gdm|gdm3)/.*$</unix:filepath>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_journal" version="1" operator="AND">
    <unix:filename operation="pattern match">^.*\.journal.*$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_lastlog" version="1">
    <unix:filename operation="pattern match">^lastlog.*$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_localmessages" version="1">
    <unix:filename operation="pattern match">^localmessages.*$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_messages" version="1">
    <unix:filename>messages</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_secure" version="1">
    <unix:filename operation="pattern match">^secure.*$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_sssd" version="1" operator="AND">
    <unix:filepath operation="pattern match">^/var/log/sssd/.*$</unix:filepath>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_syslog" version="1">
    <unix:filename>syslog</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_waagent" version="1">
    <unix:filename operation="pattern match">^waagent\.log.*$</unix:filename>
  </unix:file_state>
  {{% if 'debian' in product %}}
  <unix:file_state id="{{{ rule_id }}}_exclude_files_aide" version="1">
    <unix:filename operation="pattern match">^aideinit\..*$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_exim" version="1">
    <unix:filepath operation="pattern match">^/var/log/exim4/.*$</unix:filepath>
  </unix:file_state>
  {{% endif %}}
  {{%- if product == "ubuntu2204" %}}
  <unix:file_state id="{{{ rule_id }}}_system_files_with_empty_group" version="3">
    <unix:user_id datatype="int" operation="less than">{{{ uid_min }}}</unix:user_id>
  </unix:file_state>
  {{%- endif %}}
</def-group>
