diff --git a/schemas/oval/5.11.1/unix-definitions-schema.xsd b/schemas/oval/5.11.1/unix-definitions-schema.xsd
index eb8e499653..d08f404f04 100644
--- a/schemas/oval/5.11.1/unix-definitions-schema.xsd
+++ b/schemas/oval/5.11.1/unix-definitions-schema.xsd
@@ -3253,6 +3253,26 @@ ACTIVE_DEAD_GATEWAY_DETECTION
The SHA-512 method corresponds to the $6$ prefix.
+
+
+ The yescrypt method corresponds to the $y$ prefix.
+
+
+
+
+ The gost-yescrypt method corresponds to the $gy$ prefix.
+
+
+
+
+ The sm3-yescrypt method corresponds to the $sm3y$ prefix.
+
+
+
+
+ The scrypt method corresponds to the $7$ prefix.
+
+
The empty string value is permitted here to allow for empty elements associated with variable references.
diff --git a/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd b/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd
index c3acbef4f3..da895b3c60 100644
--- a/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd
+++ b/schemas/oval/5.11.1/unix-system-characteristics-schema.xsd
@@ -1774,6 +1774,26 @@ ACTIVE_DEAD_GATEWAY_DETECTION
The SHA-512 method corresponds to the $6$ prefix.
+
+
+ The yescrypt method corresponds to the $y$ prefix.
+
+
+
+
+ The gost-yescrypt method corresponds to the $gy$ prefix.
+
+
+
+
+ The sm3-yescrypt method corresponds to the $sm3y$ prefix.
+
+
+
+
+ The scrypt method corresponds to the $7$ prefix.
+
+
The empty string value is permitted here to allow for empty elements associated with variable references.
diff --git a/schemas/oval/5.11.2/unix-definitions-schema.xsd b/schemas/oval/5.11.2/unix-definitions-schema.xsd
index efd67210cc..11a98d02ea 100644
--- a/schemas/oval/5.11.2/unix-definitions-schema.xsd
+++ b/schemas/oval/5.11.2/unix-definitions-schema.xsd
@@ -3287,6 +3287,26 @@ ACTIVE_DEAD_GATEWAY_DETECTION
The SHA-512 method corresponds to the $6$ prefix.
+
+
+ The yescrypt method corresponds to the $y$ prefix.
+
+
+
+
+ The gost-yescrypt method corresponds to the $gy$ prefix.
+
+
+
+
+ The sm3-yescrypt method corresponds to the $sm3y$ prefix.
+
+
+
+
+ The scrypt method corresponds to the $7$ prefix.
+
+
The empty string value is permitted here to allow for empty elements associated with variable references.
diff --git a/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd b/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd
index 200225e150..eac092149c 100644
--- a/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd
+++ b/schemas/oval/5.11.2/unix-system-characteristics-schema.xsd
@@ -1808,6 +1808,26 @@ ACTIVE_DEAD_GATEWAY_DETECTION
The SHA-512 method corresponds to the $6$ prefix.
+
+
+ The yescrypt method corresponds to the $y$ prefix.
+
+
+
+
+ The gost-yescrypt method corresponds to the $gy$ prefix.
+
+
+
+
+ The sm3-yescrypt method corresponds to the $sm3y$ prefix.
+
+
+
+
+ The scrypt method corresponds to the $7$ prefix.
+
+
The empty string value is permitted here to allow for empty elements associated with variable references.
diff --git a/schemas/oval/5.11.3/unix-definitions-schema.xsd b/schemas/oval/5.11.3/unix-definitions-schema.xsd
index c91406e1f6..48bc37c561 100644
--- a/schemas/oval/5.11.3/unix-definitions-schema.xsd
+++ b/schemas/oval/5.11.3/unix-definitions-schema.xsd
@@ -3287,6 +3287,26 @@ ACTIVE_DEAD_GATEWAY_DETECTION
The SHA-512 method corresponds to the $6$ prefix.
+
+
+ The yescrypt method corresponds to the $y$ prefix.
+
+
+
+
+ The gost-yescrypt method corresponds to the $gy$ prefix.
+
+
+
+
+ The sm3-yescrypt method corresponds to the $sm3y$ prefix.
+
+
+
+
+ The scrypt method corresponds to the $7$ prefix.
+
+
The empty string value is permitted here to allow for empty elements associated with variable references.
diff --git a/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd b/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd
index 069f2c8d45..679a216cce 100644
--- a/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd
+++ b/schemas/oval/5.11.3/unix-system-characteristics-schema.xsd
@@ -1808,6 +1808,26 @@ ACTIVE_DEAD_GATEWAY_DETECTION
The SHA-512 method corresponds to the $6$ prefix.
+
+
+ The yescrypt method corresponds to the $y$ prefix.
+
+
+
+
+ The gost-yescrypt method corresponds to the $gy$ prefix.
+
+
+
+
+ The sm3-yescrypt method corresponds to the $sm3y$ prefix.
+
+
+
+
+ The scrypt method corresponds to the $7$ prefix.
+
+
The empty string value is permitted here to allow for empty elements associated with variable references.
diff --git a/schemas/oval/5.11/unix-definitions-schema.xsd b/schemas/oval/5.11/unix-definitions-schema.xsd
index 3f80c37d05..bd45c22883 100644
--- a/schemas/oval/5.11/unix-definitions-schema.xsd
+++ b/schemas/oval/5.11/unix-definitions-schema.xsd
@@ -3066,6 +3066,26 @@ ACTIVE_DEAD_GATEWAY_DETECTION
The SHA-512 method corresponds to the $6$ prefix.
+
+
+ The yescrypt method corresponds to the $y$ prefix.
+
+
+
+
+ The gost-yescrypt method corresponds to the $gy$ prefix.
+
+
+
+
+ The sm3-yescrypt method corresponds to the $sm3y$ prefix.
+
+
+
+
+ The scrypt method corresponds to the $7$ prefix.
+
+
The empty string value is permitted here to allow for empty elements associated with variable references.
diff --git a/schemas/oval/5.11/unix-system-characteristics-schema.xsd b/schemas/oval/5.11/unix-system-characteristics-schema.xsd
index 8d0de76c59..2d0d8300b0 100644
--- a/schemas/oval/5.11/unix-system-characteristics-schema.xsd
+++ b/schemas/oval/5.11/unix-system-characteristics-schema.xsd
@@ -1581,6 +1581,26 @@ ACTIVE_DEAD_GATEWAY_DETECTION
The SHA-512 method corresponds to the $6$ prefix.
+
+
+ The yescrypt method corresponds to the $y$ prefix.
+
+
+
+
+ The gost-yescrypt method corresponds to the $gy$ prefix.
+
+
+
+
+ The sm3-yescrypt method corresponds to the $sm3y$ prefix.
+
+
+
+
+ The scrypt method corresponds to the $7$ prefix.
+
+
The empty string value is permitted here to allow for empty elements associated with variable references.
diff --git a/src/OVAL/probes/unix/shadow_probe.c b/src/OVAL/probes/unix/shadow_probe.c
index a57991ccba..7e40c65219 100644
--- a/src/OVAL/probes/unix/shadow_probe.c
+++ b/src/OVAL/probes/unix/shadow_probe.c
@@ -52,6 +52,7 @@
#include
#include
#include
+#include
#include "_seap.h"
#include "probe-api.h"
@@ -96,6 +97,18 @@ struct result_info {
static SEXP_t *parse_enc_mth(const char *pwd)
{
char *mth_str;
+ bool yescrypt_mth = false;
+
+ if (pwd == NULL)
+ goto fail;
+
+ while (*pwd == '!')
+ pwd++;
+
+ if (*pwd == '\0' ||
+ *pwd == '*' ||
+ strcmp(pwd, "x") == 0)
+ goto fail;
switch (*pwd) {
case '_':
@@ -121,6 +134,30 @@ static SEXP_t *parse_enc_mth(const char *pwd)
mth_str = "SHA-512";
pwd++;
break;
+ case '7':
+ mth_str = "scrypt";
+ yescrypt_mth = true;
+ pwd++;
+ break;
+ case 'g':
+ if (strncmp(pwd, "gy", 2))
+ goto fail;
+ mth_str = "gost-yescrypt";
+ yescrypt_mth = true;
+ pwd += 2;
+ break;
+ case 's':
+ if (strncmp(pwd, "sm3y", 4))
+ goto fail;
+ mth_str = "sm3-yescrypt";
+ yescrypt_mth = true;
+ pwd += 4;
+ break;
+ case 'y':
+ mth_str = "yescrypt";
+ yescrypt_mth = true;
+ pwd++;
+ break;
default:
if (strncmp(pwd, "md5", 3))
goto fail;
@@ -131,6 +168,10 @@ static SEXP_t *parse_enc_mth(const char *pwd)
if (*pwd != '$')
goto fail;
+ if (yescrypt_mth && oval_schema_version_cmp(over,
+ OVAL_SCHEMA_VERSION(5.11)) < 0)
+ goto fail;
+
return SEXP_string_newf("%s", mth_str);
default:
return SEXP_string_newf("DES");
diff --git a/tests/probes/shadow/CMakeLists.txt b/tests/probes/shadow/CMakeLists.txt
index c461ce7dbc..e25a374861 100644
--- a/tests/probes/shadow/CMakeLists.txt
+++ b/tests/probes/shadow/CMakeLists.txt
@@ -1,4 +1,5 @@
if(ENABLE_PROBES_UNIX)
add_oscap_test("test_probes_shadow.sh")
add_oscap_test("test_probes_shadow_offline.sh")
+ add_oscap_test("test_probes_shadow_yescrypt.sh" LABELS unix linux_only)
endif()
diff --git a/tests/probes/shadow/test_probes_shadow_yescrypt.sh b/tests/probes/shadow/test_probes_shadow_yescrypt.sh
new file mode 100755
index 0000000000..2d0e61371a
--- /dev/null
+++ b/tests/probes/shadow/test_probes_shadow_yescrypt.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+
+. "$builddir/tests/test_common.sh"
+
+set -e -o pipefail
+
+tmpdir=""
+
+function test_probes_shadow_yescrypt {
+ probecheck "shadow" || return 255
+ [[ $(uname) == Linux ]] || return 255
+
+ tmpdir=$(make_temp_dir /tmp "test_shadow_yescrypt")
+ trap 'rm -rf "$tmpdir"' EXIT
+ mkdir -p "$tmpdir/etc"
+ cp "$srcdir/test_probes_shadow_yescrypt.shadow" "$tmpdir/etc/shadow"
+ set_offline_chroot_dir "$tmpdir"
+
+ local definition="$tmpdir/definitions.xml"
+ local result="$tmpdir/results.xml"
+ local items='//*[local-name()="shadow_item"]'
+ local invalid_items="$items[*[local-name()='username' and starts-with(., 'invalid_')]]"
+ local hashless_items="$items[*[local-name()='username' and starts-with(., 'hashless_')]]"
+ local schema_version
+
+ for schema_version in 5.8 5.9 5.10 5.10.1 5.11 5.11.1 5.11.2 5.11.3; do
+ sed "s/SCHEMA_VERSION_PLACEHOLDER/$schema_version/" \
+ "$srcdir/test_probes_shadow_yescrypt.xml" > "$definition"
+ local modern_count
+ case $schema_version in
+ 5.8|5.9|5.10|5.10.1)
+ xsed -i '/OVAL_5_11_ENCRYPT_METHOD/d' "$definition"
+ modern_count=0
+ ;;
+ 5.11|5.11.1|5.11.2|5.11.3)
+ modern_count=4
+ ;;
+ *)
+ printf 'Unexpected OVAL schema version: %s\n' "$schema_version" >&2
+ return 1
+ ;;
+ esac
+ $OSCAP oval eval --results "$result" "$definition"
+
+ verify_results "def" "$definition" "$result" 1
+ verify_results "tst" "$definition" "$result" 8
+ assert_exists 36 "$items"
+ local method method_items
+ for method in yescrypt gost-yescrypt sm3-yescrypt scrypt; do
+ method_items="$items[starts-with(*[local-name()='username'], '${method}_')]"
+ assert_exists 4 "$method_items"
+ assert_exists "$modern_count" "$method_items/*[local-name()='encrypt_method']"
+ assert_exists "$modern_count" \
+ "$method_items/*[local-name()='encrypt_method' and text()='$method']"
+ done
+ assert_exists 1 "$items/*[local-name()='encrypt_method' and text()='SHA-512']"
+ assert_exists 2 "$items/*[local-name()='encrypt_method' and text()='DES']"
+ assert_exists 9 "$invalid_items"
+ assert_exists 0 "$invalid_items/*[local-name()='encrypt_method']"
+ assert_exists 8 "$hashless_items"
+ assert_exists 0 "$hashless_items/*[local-name()='encrypt_method']"
+ done
+
+ # OVAL versions before 5.8 do not support encrypt_method.
+ sed 's/SCHEMA_VERSION_PLACEHOLDER/5.4/' \
+ "$srcdir/test_probes_shadow_yescrypt.xml" > "$definition"
+ xsed -i '//d' "$definition"
+ $OSCAP oval eval --results "$result" "$definition"
+ verify_results "def" "$definition" "$result" 1
+ verify_results "tst" "$definition" "$result" 8
+ assert_exists 36 "$items"
+ assert_exists 0 "$items/*[local-name()='encrypt_method']"
+
+ set_offline_chroot_dir ""
+}
+
+test_init
+test_run "test_probes_shadow_yescrypt" test_probes_shadow_yescrypt
+test_exit
diff --git a/tests/probes/shadow/test_probes_shadow_yescrypt.shadow b/tests/probes/shadow/test_probes_shadow_yescrypt.shadow
new file mode 100644
index 0000000000..1ed65b76f0
--- /dev/null
+++ b/tests/probes/shadow/test_probes_shadow_yescrypt.shadow
@@ -0,0 +1,36 @@
+yescrypt_plain:$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+yescrypt_locked:!$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+yescrypt_double_locked:!!$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+yescrypt_marker:$y$:19000:0:99999:7:::
+gost-yescrypt_plain:$gy$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+gost-yescrypt_locked:!$gy$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+gost-yescrypt_double_locked:!!$gy$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+gost-yescrypt_marker:$gy$:19000:0:99999:7:::
+sm3-yescrypt_plain:$sm3y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+sm3-yescrypt_locked:!$sm3y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+sm3-yescrypt_double_locked:!!$sm3y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+sm3-yescrypt_marker:$sm3y$:19000:0:99999:7:::
+scrypt_plain:$7$C6..../....abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+scrypt_locked:!$7$C6..../....abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+scrypt_double_locked:!!$7$C6..../....abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+scrypt_marker:$7$:19000:0:99999:7:::
+sha512:$6$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+des_plain:xZgNEJwSoPraQ:19000:0:99999:7:::
+des_locked:!xZgNEJwSoPraQ:19000:0:99999:7:::
+invalid_identifier:$yx$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+invalid_delimiter:$y:19000:0:99999:7:::
+invalid_gost_identifier:$gyx$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+invalid_gost_delimiter:$gy:19000:0:99999:7:::
+invalid_sm3_identifier:$sm3yx$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+invalid_sm3_delimiter:$sm3y:19000:0:99999:7:::
+invalid_sm3_alias:$smy$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+invalid_scrypt_identifier:$7x$C6..../....abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+invalid_scrypt_delimiter:$7:19000:0:99999:7:::
+hashless_disabled:*:19000:0:99999:7:::
+hashless_locked_disabled:!*:19000:0:99999:7:::
+hashless_locked:!:19000:0:99999:7:::
+hashless_double_locked:!!:19000:0:99999:7:::
+hashless_empty::19000:0:99999:7:::
+hashless_star_prefix:*$y$j9T$abcdefghijklmnop$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQ:19000:0:99999:7:::
+hashless_placeholder:x:19000:0:99999:7:::
+hashless_locked_placeholder:!x:19000:0:99999:7:::
diff --git a/tests/probes/shadow/test_probes_shadow_yescrypt.xml b/tests/probes/shadow/test_probes_shadow_yescrypt.xml
new file mode 100644
index 0000000000..866d1abf00
--- /dev/null
+++ b/tests/probes/shadow/test_probes_shadow_yescrypt.xml
@@ -0,0 +1,121 @@
+
+
+
+ shadow yescrypt regression test
+ 1.0
+ SCHEMA_VERSION_PLACEHOLDER
+ 2026-10-05T00:00:00Z
+
+
+
+
+ Shadow password hashing methods are detected correctly
+ Recognize yescrypt, GOST-yescrypt, SM3-yescrypt, and scrypt, including locked hashes and stripped markers, while preserving existing methods and rejecting invalid identifiers.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ^yescrypt_
+
+
+ sha512
+
+
+ ^invalid_
+
+
+ ^hashless_
+
+
+ ^des_
+
+
+ ^gost-yescrypt_
+
+
+ ^sm3-yescrypt_
+
+
+ ^scrypt_
+
+
+
+
+ ^yescrypt_
+ yescrypt
+
+
+ sha512
+ SHA-512
+
+
+ ^invalid_
+
+
+ ^hashless_
+
+
+ ^des_
+ DES
+
+
+ ^gost-yescrypt_
+ gost-yescrypt
+
+
+ ^sm3-yescrypt_
+ sm3-yescrypt
+
+
+ ^scrypt_
+ scrypt
+
+
+