<def-group>
  <definition class="compliance" id="file_group_owner_grub2_cfg" version="1">
    <metadata>
      <title>File grub.cfg Owned By root Group </title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 7</platform>
        <platform>multi_platform_fedora</platform>
      </affected>
      <description>The grub.cfg file should be owned by the root group. By default, this file is located at /boot/grub2/grub.cfg or, for EFI systems, at /boot/efi/EFI/redhat/grub.cfg</description>
      <reference source="galford" ref_id="20140909" ref_url="test_attestation" />
    </metadata>
    <criteria operator="OR">
      <criterion test_ref="test_file_group_owner_grub2_cfg" />
      <criterion test_ref="test_file_group_owner_efi_grub2_cfg" />
    </criteria>
  </definition>

  <unix:file_test check="all" check_existence="all_exist" comment="/boot/grub2/grub.cfg owned by root" id="test_file_group_owner_grub2_cfg" version="1">
    <unix:object object_ref="object_file_group_owner_grub2_cfg" />
    <unix:state state_ref="state_file_group_owner_grub2_cfg" />
  </unix:file_test>

  <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.cfg owned by root" id="test_file_group_owner_efi_grub2_cfg" version="1">
    <unix:object object_ref="object_file_group_owner_efi_grub2_cfg" />
    <unix:state state_ref="state_file_group_owner_grub2_cfg" />
  </unix:file_test>

  <unix:file_object comment="/boot/grub2/grub.cfg" id="object_file_group_owner_grub2_cfg" version="1">
    <unix:filepath>/boot/grub2/grub.cfg</unix:filepath>
  </unix:file_object>

  <unix:file_object comment="/boot/efi/EFI/redhat/grub.cfg" id="object_file_group_owner_efi_grub2_cfg" version="1">
    <unix:filepath>/boot/efi/EFI/redhat/grub.cfg</unix:filepath>
  </unix:file_object>

  <unix:file_state id="state_file_group_owner_grub2_cfg" version="1">
    <unix:group_id datatype="int">0</unix:group_id>
  </unix:file_state>
</def-group>
