Ensure no directories are unowned by a valid user
Ensures no directory on a local filesystem has an unassigned user owner (a UID not present in /etc/passwd).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A directory with no valid owner (its UID maps to no entry in /etc/passwd) is a strong sign that something is amiss: residue of a deleted account, a botched install or an intruder's artifact. If a new account later reuses that UID, it silently inherits ownership, and write control, over the orphaned directory and everything created in it. Directories in privileged paths that are not owned by a valid (ideally root) user can let an unprivileged user manipulate the execution environment, opening a privilege-escalation path.
What Pavois checks
Pavois runs find / -xdev -type d -nouser and expects empty output, any returned path is a directory whose UID maps to no user. The -xdev flag keeps the scan on the local filesystem. Resolving UIDs against the live /etc/passwd (not a static report) catches orphans left by recently deleted accounts and directories unpacked from foreign archives, which a config-file audit would never surface.
describe command("timeout 90 find / -xdev -type d -nouser -not -path '/var/lib/private/*' -not -path '/var/cache/private/*' 2>/dev/null") do
its('exit_status') { should_not cmp 124 } # timeout killed the scan: no evidence, not a pass
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Run the scan manually:
find / -xdev -type d -nouser
Expected output: nothing (empty). For each printed path, check the raw UID with stat -c '%u %n' <dir> and assign a valid owner with chown root <dir> once you understand why it was orphaned.
Inspect & investigate
List offenders with their raw UID using find / -xdev -type d -nouser -printf '%U %p\n'. Cross-reference any reused UID with getent passwd. There is no dedicated log; ownership reassignments are recorded only if an auditd watch on chown is configured.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually. Do not blindly reassign: first investigate why each directory is orphaned (deleted account, bad install, intrusion). Once understood, give it a valid owner with chown root <dir> (or the legitimate user), or remove it if it is genuine leftover debris.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | find / -xdev -type d -nouser 2>/dev/null # chown <user> <dir> per directory after review |
|---|---|
| reason | review unowned directories and assign ownership deliberately |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if left as-is: a future account created with the same UID silently takes ownership and write control of the directory and its contents, and the orphan may mask intrusion artifacts. Before fixing: an orphaned directory can be evidence, preserve it for investigation before changing it. Verify the intended owner before running chown (assigning the wrong user could grant unintended control), and delete only directories confirmed to be debris.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.4.2.5 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.