← All control domains
File permissions: 66 controls for Linux hardening
Pavois audits 66 controls in the File permissions hardening domain, across 9 systems and 5 standards (CIS, ANSSI BP-028, NIST 800-53, PCI DSS, DISA STIG). Every control declares the evidence it gathers, its severity, its remediation and its standard references.
The domain in figures
| Controls | 66 |
| Severities | |
| Evidence gathered | |
| Standards | |
| Systems | Debian 12Debian 13FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8RHEL 9 / Rocky 9 / AlmaLinux 9Ubuntu 22.04Ubuntu 24.04Ubuntu 26.04 |
| Coverage depth | in depth |
What does Pavois check in this domain?
- persistent config 54
- Checked against the content of a persistent configuration file, the source of truth that survives reboots.
- inventory state 8
- Checked against what is installed or registered, packages present/absent, account databases.
- effective runtime 3
- Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
- filesystem state 1
- Checked against a path’s metadata, mode, owner, group, SUID/SGID.
Which standards does this domain cover?
One effective-configuration check serves as evidence for several standards at once. The references below are the ones the corpus actually carries, never a claimed equivalence. how to read a standard mapping.
- CIS
- 1.2.8, 1.4.2, 1.6.4, 1.6.5, 1.6.6, 1.7.4, 1.7.5, 1.7.6, 2.2.6, 2.4.1.2, 2.4.1.3, 2.4.1.4, 2.4.1.5, 2.4.1.6, 2.4.1.7, 2.4.1.8, 2.4.1.9, 2.4.2.1, 5.1.1, 5.1.2, 5.1.3, 5.1.5, 6.1.4.1, 6.2.2.1, 6.2.4.1, 6.2.4.5, 6.2.4.8, 6.3.4.1, 6.3.4.2, 6.3.4.5, 6.3.4.8, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.1.11, 10.3.1
- ANSSI BP-028
- R29, R38, R50, R54
- NIST 800-53
- 3.1.13, 3.3.1, 3.4.5, AC-3, AC-6 (1), AC-6(1), AC-17(a), AU-9(4), AU-12 b, AU-12(b), CM-5(6), CM-5(6).1, CM-6(a), MP-2
- PCI DSS
- 1.2.8, 2.2.6, 10.3.1, 10.3.2
- DISA STIG
- UBTU-22-232020, UBTU-22-232025, UBTU-22-232030, UBTU-22-232035, UBTU-22-232140, UBTU-22-653060, UBTU-22-653065, UBTU-24-300006, UBTU-24-700030, UBTU-24-700120, UBTU-24-700150, UBTU-24-900040, UBTU-24-901230, UBTU-24-901380