Working out subject /bin/passwd policy (the nesting of which failed)