Adding descriptions to accounts_root_gid_zero about non-root users

controls/cis_almalinux9.yml

@@ -2131,8 +2131,6 @@ controls:
           - l1_workstation
       status: partial
       notes: |-
-          The rule confirms the primary group for root, but doesn't check if any other user are also
-          using GID 0. New rule is necessary.
           There is assessment but no automated remediation for this rule and this sounds reasonable.
       rules:
           - accounts_root_gid_zero

controls/cis_fedora.yml

@@ -2289,8 +2289,6 @@ controls:
           - l1_workstation
       status: partial
       notes: |-
-          The rule confirms the primary group for root, but doesn't check if any other user are also
-          using GID 0. New rule is necessary.
           There is assessment but no automated remediation for this rule and this sounds reasonable.
       rules:
           - accounts_root_gid_zero

controls/cis_rhel10.yml

@@ -2233,8 +2233,6 @@ controls:
           - l1_workstation
       status: partial
       notes: |-
-          The rule confirms the primary group for root, but doesn't check if any other user are also
-          using GID 0. New rule is necessary.
           There is assessment but no automated remediation for this rule and this sounds reasonable.
       rules:
           - accounts_root_gid_zero

linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_root_gid_zero/rule.yml

@@ -23,16 +23,16 @@ references:
     cis@sle15: 5.4.3
     pcidss: Req-8.1.1
 
-ocil_clause: 'root has a primary gid not equal to zero'
+ocil_clause: 'root has a primary gid not equal to zero or other non-system accounts has a primary gid equal to zero'
 
 ocil: |-
     To verify that root's primary group is zero run the following command:
     <pre>
-        grep '^root:' /etc/passwd | cut -d : -f 4
+        awk -F: '($1 !~ /^(sync|shutdown|halt|operator)/ &amp;&amp; $4=="0") {print $1":"$4}' /etc/passwd
     </pre>
     The command should return:
     <pre>
-    0
+        root:0
     </pre>
 
 platform: system_with_kernel