All User Files and Directories In The Home Directory Must Have a Valid Owner
Ensures every file and directory (recursively) inside each interactive user's home is owned by that user.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
If interactive users do not own all files within their home, unauthorized users may be able to access them. Files owned by another (or orphaned) UID are also a strong indicator of system compromise, for example malware dropped by a different account or leftovers from a deleted user.
What Pavois checks
Pavois reads each interactive user's UID and home from the live /etc/passwd, then runs a recursive find -P "$h" ! -uid "$u" ! -type l (symlinks excluded). Matching against the effective UID of the owner catches deep files owned by another or now-deleted account anywhere in the tree, which file-template checks would miss.
describe command('awk -F: \'($3>=1000 && $3!=65534 && $6!="/"){print $3":"$4":"$6}\' /etc/passwd | while IFS=: read u g h; do [ -d "$h" ] && timeout 60 find -P "$h" ! -uid "$u" ! -type l -print 2>/dev/null; done | head -1') do
its('exit_status') { should_not cmp 124 } # timeout killed the scan: no evidence, not a pass
its('stdout.strip') { should eq '' }
endHow to verify it is applied
For a user, run find ~user ! -uid $(id -u user) ! -type l -printf '%p %u\n'. Expected: no output. Orphaned files (no passwd entry) show as a numeric UID via find ~user -nouser.
Inspect & investigate
Ownership is inspected directly, not logged. Audit recursively with find ~user ! -uid $(id -u user) -printf '%p %u\n' and find orphans with find ~user -nouser. With file-integrity auditing enabled, chown events on home paths appear in /var/log/audit/audit.log under the relevant watch key.
Remediation
No automated remediation is shipped (remediation is empty): apply manually. For each flagged user, reclaim ownership across their home, e.g. find ~user ! -uid $(id -u user) ! -type l -exec chown $(id -un user) {} +. Treat foreign-owned or orphaned files as suspicious and review them before mass-chowning.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # Files under each home should be owned by that user: review, then chown -R deliberately per user. awk -F: '($3>=1000){print $1" "$6}' /etc/passwd |
|---|---|
| reason | re-owning a user's whole home is per-user and risky, verify before acting |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Wrongly-owned home files can leak data and may hide an intrusion. Precautions before applying: capture current ownership for forensics first (find ~user ! -uid $(id -u user) -printf '%p %u\n'), and beware of UID collisions after migrations and of recursing into bind mounts under the home, a blanket chown could re-home files that belong elsewhere. Investigate orphaned (-nouser) files instead of silently claiming them.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.