<def-group>
 <!-- THIS FILE IS GENERATED by create_permission_checks.py.  DO NOT EDIT.  -->
  <definition class="compliance" id="file_permissions_etc_passwd" version="2">
    <metadata>
      <title>Verify /etc/passwd Permissions</title>
      <affected family="unix">
        <platform>multi_platform_rhel</platform>
      </affected>
      <description>This test makes sure that /etc/passwd is owned by 0, group owned by 0, and has mode 0644 (or stronger). If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference source="JL" ref_id="20140403" ref_url="test_attestation"/>
    </metadata>
    <criteria>
      <criterion test_ref="test_etc_passwd" />
    </criteria>
  </definition>
  <unix:file_test check="all" check_existence="all_exist" comment="/etc/passwd mode and ownership" id="test_etc_passwd" version="1">
    <unix:object object_ref="object_etc_passwd" />
    <unix:state state_ref="_etc_passwd_state_uid_0" />
    <unix:state state_ref="_etc_passwd_state_gid_0" />
    <unix:state state_ref="_etc_passwd_state_mode_0644_or_stronger" />
  </unix:file_test>
  <unix:file_object comment="/etc/passwd" id="object_etc_passwd" version="1">
    <unix:filepath>/etc/passwd</unix:filepath>
  </unix:file_object>
  <unix:file_state id="_etc_passwd_state_uid_0" version="1">
    <unix:user_id datatype="int" operation="equals">0</unix:user_id>
  </unix:file_state>
  <unix:file_state id="_etc_passwd_state_gid_0" version="1">
    <unix:group_id datatype="int" operation="equals">0</unix:group_id>
  </unix:file_state>
  <unix:file_state id="_etc_passwd_state_mode_0644_or_stronger" version="2">
    <unix:suid datatype="boolean">false</unix:suid>
    <unix:sgid datatype="boolean">false</unix:sgid>
    <unix:sticky datatype="boolean">false</unix:sticky>
    <unix:uexec datatype="boolean">false</unix:uexec>
    <unix:gwrite datatype="boolean">false</unix:gwrite>
    <unix:gexec datatype="boolean">false</unix:gexec>
    <unix:owrite datatype="boolean">false</unix:owrite>
    <unix:oexec datatype="boolean">false</unix:oexec>
  </unix:file_state>
</def-group>
