passwd_invalid_gid
This built-in function ensures that each group ID (GID) listed in /etc/passwd
exists in /etc/group
. It succeeds if each GID is properly defined and fails otherwise.
Every time a group ID is defined in /etc/passwd
, it should immediately be listed in /etc/group. Otherwise, the system is in an inconsistent state and problems may arise.
Consider the following scenario: a user (“bob”) has a UID of 1000 and GID of 4000. The GID is not defined in /etc/group
, which means that the primary group of the user does not grant him any privileges today. A few months later, the system administrator edits /etc/group
and adds the group “admin” and selects the “unused” GID #4000 to identify it. Now, user “bob” by default belongs to the “admin” group even though this was not intended.
Edit /etc/group
to add the missing GIDs.
Usage
<item>
name: "passwd_invalid_gid"
description: "This check makes sure that every GID defined in /etc/passwd exists in /etc/group."
</item>