manifest-version: '0.1'
packages:
  passwd:
    transformations:
    - path-metadata:
        path: usr/bin/chfn
        mode: "u=rwxs,go=rx"
    - path-metadata:
        path: usr/bin/chsh
        mode: "u=rwxs,go=rx"
    - path-metadata:
        path: usr/bin/gpasswd
        mode: "u=rwxs,go=rx"
    - path-metadata:
        path: usr/bin/passwd
        mode: "u=rwxs,go=rx"
    - path-metadata:
        path: usr/bin/chage
        group: "shadow"
        mode: "u=rwx,go=rxs"
    - path-metadata:
        path: usr/bin/expiry
        group: "shadow"
        mode: "u=rwx,go=rxs"
  login:
    transformations:
    - path-metadata:
        path: usr/bin/newgrp
        mode: "u=rwxs,go=rx"
  uidmap:
    transformations:
    - path-metadata:
        path: usr/bin/newgidmap
        mode: "u=rwxs,go=rx"
    - path-metadata:
        path: usr/bin/newuidmap
        mode: "u=rwxs,go=rx"