<def-group>
 <!-- THIS FILE IS GENERATED by create_permission_checks.py.  DO NOT EDIT.  -->
  <definition class="compliance" id="file_permissions_etc_gshadow" version="1">
    <metadata>
      <title>Verify /etc/gshadow Permissions</title>
      <affected family="unix">
        <platform>multi_platform_rhel</platform>
      </affected>
      <description>This test makes sure that /etc/gshadow is owned by 0, group owned by 0, and has mode 0000. If
      the target file or directory has an extended ACL then it will fail the mode check.</description>
      <reference source="swells" ref_id="20130831" ref_url="test_attestation"/>
    </metadata>
    <criteria>
      <criterion test_ref="test_etc_gshadow" />
    </criteria>
  </definition>
  <unix:file_test check="all" check_existence="all_exist" comment="/etc/gshadow mode and ownership" id="test_etc_gshadow" version="1">
    <unix:object object_ref="object_etc_gshadow" />
    <unix:state state_ref="_etc_gshadow_state_uid_0" />
    <unix:state state_ref="_etc_gshadow_state_gid_0" />
    <unix:state state_ref="_etc_gshadow_state_mode_0000" />
  </unix:file_test>
  <unix:file_object comment="/etc/gshadow" id="object_etc_gshadow" version="1">
    <unix:filepath>/etc/gshadow</unix:filepath>
  </unix:file_object>
  <unix:file_state id="_etc_gshadow_state_uid_0" version="1">
    <unix:user_id datatype="int" operation="equals">0</unix:user_id>
  </unix:file_state>
  <unix:file_state id="_etc_gshadow_state_gid_0" version="1">
    <unix:group_id datatype="int" operation="equals">0</unix:group_id>
  </unix:file_state>
  <unix:file_state id="_etc_gshadow_state_mode_0000" version="1">
	<unix:suid datatype="boolean">false</unix:suid>
	<unix:sgid datatype="boolean">false</unix:sgid>
	<unix:sticky datatype="boolean">false</unix:sticky>
	<unix:uread datatype="boolean">false</unix:uread>
	<unix:uwrite datatype="boolean">false</unix:uwrite>
	<unix:uexec datatype="boolean">false</unix:uexec>
	<unix:gread datatype="boolean">false</unix:gread>
	<unix:gwrite datatype="boolean">false</unix:gwrite>
	<unix:gexec datatype="boolean">false</unix:gexec>
	<unix:oread datatype="boolean">false</unix:oread>
	<unix:owrite datatype="boolean">false</unix:owrite>
	<unix:oexec datatype="boolean">false</unix:oexec>
  </unix:file_state>
</def-group>
