Verify Only Group Root Has GID 0
Ensures no group other than root has GID 0, preventing privileged-group aliasing.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
GID 0 is the privileged root group: files owned by it and many privileged operations are gated on group root. If a second group also carries GID 0, it becomes an alias for the root group, its members and any file group-owned by it are treated as root-group, granting access that was meant to be reserved. This is a common privilege-escalation and backdoor technique, hence the high severity. Only the canonical root group must hold GID 0.
What Pavois checks
pavois scans every group entry (name + GID) and asserts that the only one with GID 0 is root. Evaluating the resolved entries rather than assuming /etc/group is the sole source keeps the check valid even when group data is partly served from another NSS backend.
describe command('awk -F: \'($3==0 && $1!="root"){print $1}\' /etc/group') do
its('stdout.strip') { should eq '' }
endHow to verify it is applied
List any non-root group sharing GID 0:
awk -F: '($3==0 && $1!="root"){print $1}' /etc/group, expected output is empty.getent group 0, expected to return only the single lineroot:x:0:.
Inspect & investigate
Group creation/modification leaves a trail:
grep -E 'groupadd|groupmod' /var/log/auth.log(Debian/Ubuntu) //var/log/secure(RHEL), shows when a group was added or its GID changed.getent group 0is the authoritative current-state probe.
Remediation
No automated harden plan is defined for this rule yet, so it must be applied manually: identify the offending group with getent group 0, then reassign it a free, non-zero GID using groupmod -g <newgid> <group>, and update ownership of any files it group-owns with find / -gid 0 -group <group> -exec chgrp <group> {} + after the renumber.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | awk -F: '($3==0 && $1!="root"){print $1}' /etc/group # groupmod -g <new-gid> <group> for each, manual |
|---|---|
| reason | a non-root group with GID 0 needs a deliberate renumber |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: a second GID-0 group acts as a hidden root-equivalent, letting its members or its group-owned files bypass intended restrictions.
Precautions before applying: before renumbering, inventory files group-owned by the offending group (find / -xdev -group <group>); after groupmod you must chgrp those files to the new GID or they become orphaned. Never reassign the root group itself. Do the change in a maintenance window and verify privileged services that depend on group root still start.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.4.2.3 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.