All User Files and Directories In The Home Directory Must Be Group-Owned By The Primary Group
Ensures every file and directory (recursively) inside each interactive user's home is group-owned by that user's primary group.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
If a user's files are group-owned by a group the user is not in control of, members of that group may read or modify private data they should not access. Consistent primary-group ownership keeps a user's data isolated to that user and their intended group.
What Pavois checks
Pavois reads the live /etc/passwd for each interactive user's primary GID and home, then runs a recursive find -P "$h" ! -gid "$g" ! -type l (symlinks excluded, no symlink traversal). It compares against the effective primary GID, catching deep files left behind by archives, restores or other users, not just the top-level dotfiles.
describe command('awk -F: \'($3>=1000 && $3!=65534 && $6!="/"){print $3":"$4":"$6}\' /etc/passwd | while IFS=: read u g h; do [ -d "$h" ] && timeout 60 find -P "$h" ! -gid "$g" ! -type l -print 2>/dev/null; done | head -1') do
its('exit_status') { should_not cmp 124 } # timeout killed the scan: no evidence, not a pass
its('stdout.strip') { should eq '' }
endHow to verify it is applied
For a user, run find ~user ! -gid $(id -g user) ! -type l -printf '%p %g\n'. Expected: no output (the whole tree is group-owned by the primary group).
Inspect & investigate
Group ownership is inspected directly, not logged. Audit recursively with find ~user ! -gid $(id -g user) -printf '%p %g\n'. With file-integrity auditing enabled, chgrp events on home paths appear in /var/log/audit/audit.log under the relevant watch key.
Remediation
No automated remediation is shipped (remediation is empty): apply manually. For each flagged user, reset group ownership across their home, e.g. find ~user ! -gid $(id -g user) ! -type l -exec chgrp $(id -gn user) {} +. Review unusual paths first rather than blindly recursing.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -F: '($3>=1000){print $1" "$6}' /etc/passwd # chgrp -R <group> <home> per user after review |
|---|---|
| reason | re-grouping a user's whole home is per-user, verify before acting |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Wrong group ownership can leak or expose private files to a shared group. Precautions before applying: some legitimate workflows place shared-project files under a collaboration group inside $HOME, a blanket chgrp to the primary group would revoke that sharing. Inspect the offending paths, exclude deliberate shared subtrees, and beware of recursing into mounted filesystems under the home.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.