User Initialization Files Must Be Group-Owned By The Primary Group
Ensures the dotfiles (e.g. .bashrc, .profile) at the top level of each interactive user's home are group-owned by that user's primary group.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Local initialization files configure a user's shell environment at login. If a dotfile is group-owned by a group the user does not control, a member of that group could modify the file and execute code in the victim's session the next time they log in, a privilege/account compromise on logon.
What Pavois checks
Pavois reads the live /etc/passwd to learn each interactive user's UID, primary GID and home, then runs find -maxdepth 1 -type f -name '.[^.]*' ! -gid "$g" against the home that actually exists on disk. It compares against the effective primary GID from passwd, so it catches dotfiles left group-owned by a stale or shared group, regardless of any skeleton template.
describe command('awk -F: \'($3>=1000 && $3!=65534 && $6!="/"){print $3":"$4":"$6}\' /etc/passwd | while IFS=: read u g h; do [ -d "$h" ] && timeout 60 find -P "$h" -maxdepth 1 -type f -name \'.[^.]*\' ! -gid "$g" -print 2>/dev/null; done | head -1') do
its('exit_status') { should_not cmp 124 } # timeout killed the scan: no evidence, not a pass
its('stdout.strip') { should eq '' }
endHow to verify it is applied
For a user, run find ~user -maxdepth 1 -type f -name '.[^.]*' ! -gid $(id -g user) -printf '%p %g\n'. Expected: no output (every dotfile is group-owned by the primary group).
Inspect & investigate
There is no event log; ownership is inspected directly. Audit with ls -la ~user | grep '^\.' or stat -c '%U %G %n' ~user/.*. If file-integrity auditing is active, group-ownership changes (chgrp) on these paths appear in /var/log/audit/audit.log under the relevant watch key.
Remediation
No automated remediation is shipped (remediation is empty): apply manually. For each flagged user, reset group ownership of their top-level dotfiles to the primary group, e.g. find ~user -maxdepth 1 -type f -name '.[^.]*' ! -gid $(id -g user) -exec chgrp $(id -gn user) {} +.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | for d in $(awk -F: '($3>=1000){print $6}' /etc/passwd); do find "$d" -maxdepth 1 -name '.*' 2>/dev/null; done # chgrp <user-group> per file after review |
|---|---|
| reason | fixing dot-file group is per-user, verify before chgrp'ing a user's files |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Leaving dotfiles owned by a shared group enables code execution in another user's session at logon. Precautions before applying: confirm the intended primary group with id -gn <user> first, some sites deliberately use a shared collaboration group; blindly running chgrp could break workflows or revoke needed group access. Apply per-user and avoid recursing into bind-mounted or symlinked subtrees.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 7.2.10, 7.2.9 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.