Verify Permissions on passwd File
Ensures /etc/passwd is not writable, executable, setuid/setgid or sticky for group or other, so only root can modify the account database.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/etc/passwd holds every account on the system (login name, UID, GID, home directory and shell) and is world-readable by design so programs can resolve user names. The danger is write access: if the file is writable by its group or by other, an unprivileged user could add an account, change another user's UID to 0, or alter a login shell, a direct path to privilege escalation. setuid/setgid/executable bits are meaningless on this text file and only enlarge the attack surface. Only root must be able to write it.
What Pavois checks
Pavois reads the live mode bits of /etc/passwd on the target, the effective permissions stored in the inode, rather than a documented baseline. There is no include or drop-in to subvert; the audit sees exactly what the kernel enforces. The only_if guard skips the control if the file is somehow absent.
only_if { file('/etc/passwd').exist? }
describe file('/etc/passwd') do
it { should_not be_executable.by('owner') }
it { should_not be_setuid }
it { should_not be_executable.by('group') }
it { should_not be_writable.by('group') }
it { should_not be_setgid }
it { should_not be_executable.by('other') }
it { should_not be_writable.by('other') }
it { should_not be_sticky }
endHow to verify it is applied
Run stat -c '%A %U %G' /etc/passwd. Expected: mode -rw-r--r-- (0644) owned by root root, with no write bit for group/other and no s/t bits. Quick check: find /etc/passwd -perm /0133 must return nothing.
Inspect & investigate
Permission changes are not logged by default. Because /etc/passwd is security-sensitive, watch it with auditd: auditctl -w /etc/passwd -p wa -k identity, then review with grep 'key="identity"' /var/log/audit/audit.log. Current mode and ownership: stat /etc/passwd.
Remediation
No automated harden plan ships for this rule yet, so it must be applied manually: chown root:root /etc/passwd && chmod 0644 /etc/passwd. This removes any group/other write and any setuid/setgid/sticky bits while keeping the file world-readable, as required for name resolution.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| mode | 0644 |
|---|---|
| path | /etc/passwd |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if left mis-set: writable /etc/passwd allows an attacker to inject a UID 0 account or change shells, a textbook privilege escalation. Applying the fix is safe: 0644 root:root is the standard mode shipped by every distribution. Precaution: do not drop the read bit for group/other, countless programs (ls -l, id, login) need to read it, and removing world-read breaks name resolution and most logins.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 2.2.6, 7.1.1 | direct | per OS, see the benchmark table | high |
| NIST | AC-6(1), CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 2.2.6 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.