← All rules
SOCLE-CLD-IAM-014// Accounts (home dirs)mediumfilesystem state

All User Files and Directories In The Home Directory Must Have a Valid Owner

Ensures every file and directory (recursively) inside each interactive user's home is owned by that user.

Checked against a path’s metadata, mode, owner, group, SUID/SGID.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 1 standard

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

If interactive users do not own all files within their home, unauthorized users may be able to access them. Files owned by another (or orphaned) UID are also a strong indicator of system compromise, for example malware dropped by a different account or leftovers from a deleted user.

What Pavois checks

Pavois reads each interactive user's UID and home from the live /etc/passwd, then runs a recursive find -P "$h" ! -uid "$u" ! -type l (symlinks excluded). Matching against the effective UID of the owner catches deep files owned by another or now-deleted account anywhere in the tree, which file-template checks would miss.

describe command('awk -F: \'($3>=1000 && $3!=65534 && $6!="/"){print $3":"$4":"$6}\' /etc/passwd | while IFS=: read u g h; do [ -d "$h" ] && timeout 60 find -P "$h" ! -uid "$u" ! -type l -print 2>/dev/null; done | head -1') do
  its('exit_status') { should_not cmp 124 }  # timeout killed the scan: no evidence, not a pass
  its('stdout.strip') { should eq '' }
end

How to verify it is applied

For a user, run find ~user ! -uid $(id -u user) ! -type l -printf '%p %u\n'. Expected: no output. Orphaned files (no passwd entry) show as a numeric UID via find ~user -nouser.

Inspect & investigate

Ownership is inspected directly, not logged. Audit recursively with find ~user ! -uid $(id -u user) -printf '%p %u\n' and find orphans with find ~user -nouser. With file-integrity auditing enabled, chown events on home paths appear in /var/log/audit/audit.log under the relevant watch key.

Remediation

No automated remediation is shipped (remediation is empty): apply manually. For each flagged user, reclaim ownership across their home, e.g. find ~user ! -uid $(id -u user) ! -type l -exec chown $(id -un user) {} +. Treat foreign-owned or orphaned files as suspicious and review them before mass-chowning.

Pavois applies this with its own harden engine, the plan below, not a shell script:

command# Files under each home should be owned by that user: review, then chown -R deliberately per user. awk -F: '($3>=1000){print $1" "$6}' /etc/passwd
reasonre-owning a user's whole home is per-user and risky, verify before acting
resourcemanual
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Wrongly-owned home files can leak data and may hide an intrusion. Precautions before applying: capture current ownership for forensics first (find ~user ! -uid $(id -u user) -printf '%p %u\n'), and beware of UID collisions after migrations and of recursing into bind mounts under the home, a blanket chown could re-home files that belong elsewhere. Investigate orphaned (-nouser) files instead of silently claiming them.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R50direct2.0high

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references

Official standards

ANSSI-BP-028 (2.0) ↗