# HG changeset patch
# User jfp <jf.pieronne@laposte.net>
# Date 1674839299 -3600
#      Fri Jan 27 18:08:19 2023 +0100
# Node ID 4f499d0118fc518f433672dc08c96d5a419beefa
# Parent  5cbf37fbfc7ce91352c86d66a3a6b24ec0038028
Fix rule 9001

diff --git a/secrules/rules09.py b/secrules/rules09.py
--- a/secrules/rules09.py
+++ b/secrules/rules09.py
@@ -13,12 +13,17 @@
 @level_rule(2)
 def rule0901(fo, fmt):
     """Files accessible by non-privileged users
-    
+
     The integrity of VMS startup files is critical to the security and
-    integrity of the operating environment.  Improper access to startup files
+    integrity of the operating environment. Improper access to startup files
     can allow unauthorized users to modify their own or another user's execution
     environment."""
 
+    ebit = 0x4
+    wbit = 0x2
+    dbit = 0x8
+    rbit = 0x1
+
     if not fmt:
         print(file=fo)
         print('RULE 0901', file=fo)
@@ -37,12 +42,8 @@
             )[2][
                 ossdef.OSS__PROTECTION
             ]   # type: ignore
-            if not (
-                (prot & 0x8000)
-                and (prot & 0x4000)
-                and (prot & 0x2000)
-                and (prot & 0x1000)
-            ):
+            wprot = (prot & 0xF000) >> 12
+            if (wprot & wbit) == 0 or (wprot & dbit) == 0:
                 if fmt:
                     print('0901"2"', fn, file=fo)
                 else:
@@ -57,10 +58,12 @@
 @level_rule(3)
 def rule0902(fo, fmt):
     """Embedded command procedure not found
-    
+
     During checking of the listed files for non-privileged access, either:
     1) An attempt to open the files to check for other called procedures resulted
-    in an open failure,  -OR- 2) The listed command procedures reference other
+    in an open failure,
+    -OR-
+    2) The listed command procedures reference other
     command procedures which were not found.  If a file was required and deleted,
     a user could create a file with the same name.  This file then would run with
     privileged access allowing a user to gain unauthorized system access."""
@@ -83,7 +86,7 @@
 @level_rule(2)
 def rule0903(fo, fmt):
     """Startup file not found
-    
+
     This indicates either a system configuration inconsistency or an
     inconsistency in the review criteria."""