Verify User Who Owns group File
Ensures the /etc/group file is owned by the root user (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/group defines every group on the system and its membership, which drives authorization decisions across the OS. If a non-root user owns it, they could add themselves to privileged groups (e.g. sudo, wheel, docker) and escalate privileges, or remove others from groups to cause denial of service. Ownership by root is essential to system security.
What Pavois checks
Pavois stats the live inode of /etc/group and asserts its owner is UID 0. Reading the actual filesystem metadata reflects the effective ownership the authentication stack relies on at every login and id lookup, not an installer default.
only_if { file('/etc/group').exist? }
describe file('/etc/group') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /etc/group. The expected output is root 0.
Inspect & investigate
Group changes via groupadd/gpasswd/usermod are logged in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL family). To detect direct edits, set an audit watch: auditctl -w /etc/group -p wa -k group, then review /var/log/audit/audit.log (grep for key="group").
Remediation
No automated harden plan is defined for this rule yet, so it must be fixed manually: run chown root /etc/group to restore root ownership.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/group |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner of /etc/group can grant themselves privileged group membership and achieve privilege escalation. Fixing it is essentially risk-free: chown root /etc/group does not change any group definition, so all logins and group lookups keep working. The change applies immediately; no service restart or reboot is needed.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 2.2.6, 7.1.3 | direct | per OS, see the benchmark table | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.