From 2e33bfa163699b4385ea34f77f1b4602ade2a50f Mon Sep 17 00:00:00 2001
From: Alan Moore <alan.moore@canonical.com>
Date: Thu, 9 Jan 2025 10:15:01 +0000
Subject: [PATCH] Add check none_exist

---
 .../root_logins/accounts_root_gid_zero/oval/shared.xml   | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_root_gid_zero/oval/shared.xml b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_root_gid_zero/oval/shared.xml
index f1b3ed4a1d4f..1acc77321a8d 100644
--- a/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_root_gid_zero/oval/shared.xml
+++ b/linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_root_gid_zero/oval/shared.xml
@@ -26,19 +26,14 @@
 
   {{% if 'ubuntu' in product %}}
   <!-- Test for other users with GID 0 (excluding sync, shutdown, halt, operator) -->
-  <ind:textfilecontent54_test id="test_{{{rule_id}}}_no_other_gid_0" check="all" comment="test that there are no other accounts with GID 0 except root" version="1">
+  <ind:textfilecontent54_test id="test_{{{rule_id}}}_no_other_gid_0" check="all" check_existence="none_exist" comment="test that there are no other accounts with GID 0 except root" version="1">
     <ind:object object_ref="object_{{{rule_id}}}_no_other_gid_0" />
-    <ind:state state_ref="state_{{{rule_id}}}_no_other_gid_0" />
   </ind:textfilecontent54_test>
 
   <ind:textfilecontent54_object id="object_{{{rule_id}}}_no_other_gid_0" version="1">
     <ind:filepath>/etc/passwd</ind:filepath>
-    <ind:pattern operation="pattern match">^(?!\b(root|sync|shutdown|halt|operator)\b).+:.+:\d+:(\d+).+</ind:pattern>
+    <ind:pattern operation="pattern match">^(?!\b(root|sync|shutdown|halt|operator)\b).+:.+:\d+:0:.+$</ind:pattern>
     <ind:instance datatype="int">1</ind:instance>
   </ind:textfilecontent54_object>
-
-  <ind:textfilecontent54_state id="state_{{{rule_id}}}_no_other_gid_0" version="1" comment="no other users have GID 0">
-    <ind:subexpression operation="not equal" datatype="int">0</ind:subexpression>
-  </ind:textfilecontent54_state>
   {{% endif %}}
 </def-group>