<def-group>
  <definition class="compliance" id="{{{ rule_id }}}" version="1">
      {{{ oval_metadata("Group owner of /var/log/* should be root or adm.", rule_title=rule_title) }}}
    <criteria comment="Check group ownership of /var/log/*">
     <criterion test_ref="test_group_ownership_var_log" />
    </criteria>
  </definition>

  <ind:textfilecontent54_object id="object_adm_gid" version="1" comment="gid of the dedicated adm group">
    <ind:filepath>/etc/group</ind:filepath>
    <ind:pattern operation="pattern match">^adm:\w+:(\w+):.*</ind:pattern>
    <ind:instance datatype="int" operation="equals">1</ind:instance>
  </ind:textfilecontent54_object>
  <local_variable id="var_adm_gid" datatype="int" version="1"
                  comment="Retrieve the gid of adm group">
    <object_component item_field="subexpression" object_ref="object_adm_gid"/>
  </local_variable>

  <unix:file_test check="all" comment="/var/log/* group owner is root|adm"
      id="test_group_ownership_var_log" state_operator="OR" version="1">
    <unix:object object_ref="object_group_ownership_var_log" />
    <unix:state state_ref="state_group_ownership_adm_var_log_auth_log"/>
    <unix:state state_ref="state_group_ownership_root_var_log_auth_log"/>
    {{%- if product == "ubuntu2204" %}}
    <unix:state state_ref="{{{ rule_id }}}_group_only_has_sys_uids"/>
    {{%- endif %}}
  </unix:file_test>
  <unix:file_object comment="/var/log/*" id="object_group_ownership_var_log" version="1">
    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
    <unix:path>/var/log</unix:path>
    <unix:filename operation="pattern match">.*</unix:filename>
    <filter action="exclude">{{{ rule_id }}}_exclude_symlinks</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_apt</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_auth_log</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_bwtmp</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_cloudinit</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_gdm</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_journal</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_landscape</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_lastlog</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_localmessages</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_messages</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_secure</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_sssd</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_syslog</filter>
    <filter action="exclude">{{{ rule_id }}}_exclude_files_waagent</filter>
  </unix:file_object>
  <unix:file_state id="{{{ rule_id }}}_exclude_symlinks" version="1">
    <unix:type operation="equals">symbolic link</unix:type>
  </unix:file_state>
  <unix:file_state id="state_group_ownership_adm_var_log_auth_log" version="1">
    <unix:group_id datatype="int" operation="equals" var_ref="var_adm_gid"/>
  </unix:file_state>
  <unix:file_state id="state_group_ownership_root_var_log_auth_log" version="1">
    <unix:group_id datatype="int" operation="equals">0</unix:group_id>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_apt" version="1">
    <unix:filepath operation="pattern match">^/var/log/apt/.*</unix:filepath>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_landscape" version="1">
    <unix:filepath operation="pattern match">^/var/log/landscape/.*</unix:filepath>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_auth_log" version="1">
    <unix:filename>auth.log</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_bwtmp" version="1">
    <unix:filename operation="pattern match">^[bw]tmp((\.|-).*)?$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_cloudinit" version="1">
    <unix:filename operation="pattern match">^cloud-init\.log.*</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_gdm" version="1" operator="AND">
    <unix:filepath operation="pattern match">^/var/log/(gdm|gdm3)/.*$</unix:filepath>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_journal" version="1" operator="AND">
    <unix:filename operation="pattern match">^.*\.journal.*$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_lastlog" version="1">
    <unix:filename operation="pattern match">^lastlog.*$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_localmessages" version="1">
    <unix:filename operation="pattern match">^localmessages.*$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_messages" version="1">
    <unix:filename>messages</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_secure" version="1">
    <unix:filename operation="pattern match">^secure.*$</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_sssd" version="1" operator="AND">
    <unix:filepath operation="pattern match">^/var/log/sssd/.*$</unix:filepath>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_syslog" version="1">
    <unix:filename>syslog</unix:filename>
  </unix:file_state>
  <unix:file_state id="{{{ rule_id }}}_exclude_files_waagent" version="1">
    <unix:filename operation="pattern match">^waagent\.log.*$</unix:filename>
  </unix:file_state>
  {{%- if product == "ubuntu2204" %}}
  <unix:file_state id="{{{ rule_id }}}_group_only_has_sys_uids" version="1">
    <unix:group_id datatype="int" var_ref="empty_group_ids" var_check="at least one"/>
  </unix:file_state>

  <local_variable id="empty_group_ids" comment="Group IDs with no members" datatype="int" version="1">
    <object_component item_field="subexpression" object_ref="empty_members_in_etc_group"/>
  </local_variable>

  <ind:textfilecontent54_object comment="Groups with no members" id="empty_members_in_etc_group" version="1">
    <ind:filepath>/etc/group</ind:filepath>
     <ind:pattern operation="pattern match" var_ref="variable_{{{ rule_id }}}_group_regex" var_check="at least one"/>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <local_variable id="variable_{{{ rule_id }}}_group_regex" datatype="string" version="1" comment="gid rows retrieved from /etc/passwd">
    <concat>
      <literal_component>^[^:]+:[^:]*:(</literal_component>
      <object_component item_field="subexpression" object_ref="obj_{{{ rule_id }}}_gids_with_only_sys_uids" />
      <literal_component>):$</literal_component>
    </concat>
  </local_variable>

  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}_gids_with_only_sys_uids" version="1">
    <ind:filepath>/etc/passwd</ind:filepath>
    <ind:pattern operation="pattern match" var_ref="variable_{{{ rule_id }}}_regex" var_check="at least one"/>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>

  <local_variable id="variable_{{{ rule_id }}}_regex" datatype="string" version="1" comment="uid rows retrieved from /etc/passwd">
    <concat>
      <literal_component>^[^:]*:[^:]*:</literal_component>
        <object_component item_field="subexpression" object_ref="obj_{{{ rule_id }}}_sys_uid" />
      <literal_component>:(\d+):.*$</literal_component>
    </concat>
  </local_variable>

  <ind:textfilecontent54_object id="obj_{{{ rule_id }}}_sys_uid" version="1">
    <ind:filepath>/etc/passwd</ind:filepath>
    <ind:pattern operation="pattern match">^[^:]+:[^:]*:(\d\d?\d?):.*$</ind:pattern>
    <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
  </ind:textfilecontent54_object>
  {{%- endif %}}
</def-group>
