User Initialization Files Must Be Owned By the Primary User
Ensures the dotfiles (e.g. .bashrc, .profile) at the top level of each interactive user's home are owned by that user.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Local initialization files configure a user's shell environment at login. If a dotfile is owned by a different user, that user can rewrite it and have arbitrary code run inside the victim's session at next logon. Foreign ownership of init files is also a classic sign of system compromise.
What Pavois checks
Pavois derives each interactive user's UID and home from the live /etc/passwd, then runs find -maxdepth 1 -type f -name '.[^.]*' ! -uid "$u" on the existing home. By comparing against the effective UID of the account owner, it catches any dotfile owned by someone else, exactly what an attacker would plant, without trusting a packaging or skeleton assumption.
describe command('awk -F: \'($3>=1000 && $3!=65534 && $6!="/"){print $3":"$4":"$6}\' /etc/passwd | while IFS=: read u g h; do [ -d "$h" ] && timeout 60 find -P "$h" -maxdepth 1 -type f -name \'.[^.]*\' ! -uid "$u" -print 2>/dev/null; done | head -1') do
its('exit_status') { should_not cmp 124 } # timeout killed the scan: no evidence, not a pass
its('stdout.strip') { should eq '' }
endHow to verify it is applied
For a user, run find ~user -maxdepth 1 -type f -name '.[^.]*' ! -uid $(id -u user) -printf '%p %u\n'. Expected: no output (every dotfile is owned by the user).
Inspect & investigate
Ownership is inspected directly, not logged. Audit with ls -la ~user | grep '^\.' or stat -c '%U %n' ~user/.*. With file-integrity auditing enabled, chown operations on these paths appear in /var/log/audit/audit.log under the relevant watch key.
Remediation
No automated remediation is shipped (remediation is empty): apply manually. For each flagged user, reclaim ownership of their top-level dotfiles, e.g. find ~user -maxdepth 1 -type f -name '.[^.]*' ! -uid $(id -u user) -exec chown $(id -un user) {} +. Investigate why a foreign UID owned them, it may indicate compromise rather than a benign mistake.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # Dot-files in a home must be owned by that user. List offenders, then chown deliberately. for d in $(awk -F: '($3>=1000){print $6}' /etc/passwd); do find "$d" -maxdepth 1 -name '.*' ! -user "$(stat -c %U "$d")" 2>/dev/null; done |
|---|---|
| reason | fixing dot-file ownership is per-user, verify before chowning a user's files |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Foreign-owned init files allow session hijack at logon and may mask an intrusion. Precautions before applying: before running chown, capture the current owner (stat -c '%U %n') for forensics, and confirm the home truly belongs to the listed account, a UID collision after a migration can make legitimate files appear foreign. Avoid recursing past the top level to limit blast radius.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
| CIS | 7.2.10, 7.2.9 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.