All User Files and Directories In The Home Directory Must Have Mode 0750 Or Less Permissive
Ensures every file and directory in each interactive user's home is mode 0750 or stricter, no group-write, no world access, and no unexpected setuid/setgid/sticky bits.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Excessive permissions on home files let unintended users read private data or modify files the owner relies on. World-readable or group-writable home content exposes credentials, keys and shell init files; stray setuid/setgid bits can become a privilege-escalation foothold.
What Pavois checks
Pavois reads the live /etc/passwd for interactive users and homes, then runs find -P "$h" -perm /7027 ! -type l. The /7027 mask flags any path carrying setuid/setgid/sticky (7000), group-write (020) or any world bit (007), i.e. anything looser than 0750. Inspecting the effective on-disk mode catches files created loose by tools or umask, beyond what a skeleton template would suggest.
describe command('awk -F: \'($3>=1000 && $3!=65534 && $6!="/"){print $3":"$4":"$6}\' /etc/passwd | while IFS=: read u g h; do [ -d "$h" ] && timeout 60 find -P "$h" -perm /7027 ! -type l -print 2>/dev/null; done | head -1') do
its('exit_status') { should_not cmp 124 } # timeout killed the scan: no evidence, not a pass
its('stdout.strip') { should eq '' }
endHow to verify it is applied
For a user, run find ~user -perm /7027 ! -type l -printf '%m %p\n'. Expected: no output (every entry is 0750 or stricter, with no setuid/setgid/sticky bits).
Inspect & investigate
Permissions are inspected directly, not logged. Audit with find ~user -perm /7027 ! -type l -printf '%m %p\n' or stat -c '%a %n' <path>. With file-integrity auditing enabled, chmod events on home paths appear in /var/log/audit/audit.log under the relevant watch key.
Remediation
No automated remediation is shipped (remediation is empty): apply manually. For each flagged user, strip the excess bits, e.g. find ~user -perm /7027 ! -type l -exec chmod g-w,o-rwx {} + (review setuid/setgid hits separately before removing those bits).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -F: '($3>=1000 && $3!=65534 && $6!="/"){print $6}' /etc/passwd | while read h; do [ -d "$h" ] && find "$h" -perm /7027 ! -type l -exec chmod u-s,g-w-s,o=- {} + 2>/dev/null; done; true |
|---|---|
| name | fix-home-perms |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Over-permissive home files expose secrets and allow tampering. Precautions before applying: a blunt chmod can break apps that legitimately need group access (shared dev directories, ~/.gnupg already at 0700, sockets), review the matched paths first. Stripping o-rwx is safe for private homes, but removing setuid/setgid blindly may break intentionally-privileged helpers, so handle 7000-mask hits case by case.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R50 | direct | 2.0 | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.