login_shells_bad_owner
This built-in function ensures that every shell belongs to the “root” or “bin” users.
As for shells with invalid permissions, if a user owns a shell used by other users, then they can modify it to force third party users to execute arbitrary commands when they log in.
Only “root” and/or “bin” should be able to modify system-wide binaries.
Usage
<item>
name: "login_shells_bad_owner"
description: "This check reports user accounts with login shells that are not owned by root or bin."
</item>