get shadow password file entry on Linux

rule:
  meta:
    name: get shadow password file entry on Linux
    namespace: collection
    authors:
      - jonathanlepore@google.com
    scopes:
      static: instruction
      dynamic: call
    references:
      - https://manpages.ubuntu.com/manpages/noble/man3/getspent.3.html
  features:
    - and:
      - os: linux
      - or:
        - api: getspent
        - api: getspent_r
        - api: fgetspent
        - api: fgetspent_r
        - api: getspnam
        - api: getspnam_r