Ensure home directory files are group-owned by a group of the home owner

fail=0
tab=$(printf '\t')
while IFS=: read -r user _ uid _ _ home shell; do
  [ "$uid" -ge 1000 ] 2>/dev/null || continue
  [ "$uid" -lt 65534 ] 2>/dev/null || continue   # exclude nobody (home=/)
  case "$shell" in */nologin|*/false|"") continue ;; esac
  [ -d "$home" ] || continue
  usergids=" $(id -G "$user" 2>/dev/null) "
  # %G is the NUMERIC gid (matches id -G); %g would be the group NAME.
  bad=$(find "$home" -xdev \( -type f -o -type d \) -printf "%G${tab}%p\n" 2>/dev/null \
        | while IFS="$tab" read -r g p; do
            case "$usergids" in
              *" $g "*) : ;;
              *) echo "$p (gid $g)" ;;
            esac
          done | head -5)
  if [ -n "$bad" ]; then
    echo "FAIL: $home has files group-owned by a group $user is not in:"
    echo "$bad"
    fail=1
  fi
done < /etc/passwd
if [ "$fail" -eq 0 ]; then
  echo "OK: home directory files are group-owned by a group of their owner"
  exit 0
fi
exit 1

expected_exit:

0

note:

For each flagged file, set the group to one the home owner is a member of (typically the user's primary group), or document the exception: chgrp <group-user-is-member-of> <file>