Verify User Who Owns passwd File
Ensures the local account database /etc/passwd is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /etc/passwd file lists every local account along with its UID, GID, home directory and login shell. If a non-root account owns it, that user could add accounts, change UIDs (e.g. give themselves UID 0) or alter login shells, a direct path to privilege escalation. Setting root (UID 0) as the owner restricts modification to privileged users and protects the integrity of the account database.
What Pavois checks
Pavois inspects the live filesystem with the InSpec file('/etc/passwd') resource and asserts uid == 0, guarded by only_if. Reading the real inode owner (not a provisioning manifest) reveals the effective state on disk, including any chown performed after deployment by an operator script or an attacker who gained transient root.
only_if { file('/etc/passwd').exist? }
describe file('/etc/passwd') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u %n' /etc/passwd. Expected output: root 0 /etc/passwd. The numeric 0 confirms root ownership.
Inspect & investigate
Distributions usually ship an audit rule watching this file (key identity). Inspect /var/log/audit/audit.log with grep 'key="identity"' to see any write/attribute change. If absent, add auditctl -w /etc/passwd -p wa -k identity. Account additions also surface via journalctl (useradd/usermod).
Remediation
No automated remediation is shipped for this rule. Apply it manually with chown root /etc/passwd (run as root or via sudo); the file must remain group root and mode 0644.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /etc/passwd |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner of /etc/passwd is a serious escalation vector. Risk of applying: very low, restoring root ownership is the system default and does not break logins. Precaution: do NOT also tighten the mode below 0644; /etc/passwd must stay world-readable, as countless tools (ls -l, id, name resolution) depend on it. Only the owner is corrected here.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 2.2.6, 7.1.1 | direct | per OS, see the benchmark table | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.