Verify Root Has A Primary GID 0
Ensures the root account's primary group (4th field of its /etc/passwd line) is GID 0.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The root account must have primary group GID 0 (the root group). If root's primary GID points to a shared or user group instead, files that root creates inherit that group, exposing them to every member of it. Keeping root's primary GID at 0 guarantees that root-owned files stay under exclusive root-group control.
What Pavois checks
Pavois uses awk to print root's /etc/passwd line only when its 4th field (primary GID) is not 0. The check passes only when nothing is printed. Reading the resolved account database confirms the effective primary group rather than assuming a default.
describe command('awk -F: \'($1=="root" && $4!=0){print}\' /etc/passwd') do
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Run awk -F: '($1=="root" && $4!=0){print}' /etc/passwd (or id -g root, which should return 0). Expected: empty output / 0. Any printed line means root's primary GID is wrong.
Inspect & investigate
- Check root's primary group directly:
id rootorgetent passwd root. - Audit files mis-grouped by a wrong root GID:
find / -user root ! -group root -ls(subset, expect many legitimate hits). - Account/login events:
/var/log/auth.logor/var/log/secure.
Remediation
No automated remediation is shipped. Fix it manually with usermod -g 0 root to set root's primary group back to GID 0, then re-run the scan to confirm.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | id -g root usermod -g 0 root # set root's primary GID to 0 (only if the audit flagged it) |
|---|---|
| reason | changing root's primary group is sensitive, confirm before applying |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-zero root primary GID causes root-created files to be group-owned by a non-root group, potentially exposing sensitive content to its members. The fix is low-risk; still, back up /etc/passwd first and be aware that existing files created earlier keep their old group and may need re-grouping.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.4.2.2, 8.2.1 | direct | per OS, see the benchmark table | high |
| PCI DSS | 8.2.1 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.