Ensure systemd-tmpfiles enforces mode 0600 on root initialization files

# tmpfiles.d C-entries: "C /root/.bashrc 600 root root - /usr/share/rootfiles/.bashrc"
# (type=$1, path=$2, mode=$3). The vendor default (/usr/lib/tmpfiles.d)
# ships these at 644; the STIG requires an admin OVERRIDE in
# /etc/tmpfiles.d (which wins by precedence) setting <=0600, and a missing
# override is itself a finding. So check only /etc/tmpfiles.d, matching the
# STIG check-content (grepping /usr/lib too would false-FAIL a host whose
# /etc override already corrects the vendor mode).
lines=$(grep -rhE '/usr/share/rootfiles/' /etc/tmpfiles.d/*.conf 2>/dev/null \
          | grep -v '^[[:space:]]*#')
if [ -z "$lines" ]; then
  echo "FAIL: no /etc/tmpfiles.d override enforces mode 0600 on /usr/share/rootfiles/ init files (vendor default is 0644)"
  exit 1
fi
bad=$(printf '%s\n' "$lines" | awk '$3 !~ /^0?[0-6]00$/ {print}')
if [ -n "$bad" ]; then
  echo "FAIL: tmpfiles.d rootfiles entries specify a mode more permissive than 0600:"
  printf '%s\n' "$bad" | sed 's/^/  /'
  exit 1
fi
echo "OK: all tmpfiles.d rootfiles entries enforce mode 0600 or less permissive"
exit 0

expected_exit:

0

note:

Ensure /etc/tmpfiles.d contains C-entries copying each /usr/share/rootfiles/ file to /root with mode 600, e.g. "C /root/.bashrc 600 root root - /usr/share/rootfiles/.bashrc", then run systemd-tmpfiles --create.