---
title: All Interactive User Home Directories Must Be Group-Owned By The Primary Group
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > All Interactive User Home Directories
  Must Be Group-Owned By The Primary Group
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# All Interactive User Home Directories Must Be Group-Owned By The Primary Group
 
## Description{% #description %}

Change the group owner of interactive user home directories to the group found in `getent passwd`. To change the group owner of an interactive user's home directory, use the following command:

```
$ sudo chgrp USER_GROUP /home/USER
```

This rule ensures every home directory related to an interactive user is group-owned by that user's primary group. It also ensures that interactive users are group-owners of one and only one home directory. Interactive users are those with a UID greater than or equal to 1000 and a valid interactive shell (not `/sbin/nologin`, `/usr/sbin/nologin`, `/bin/false`, or `/usr/bin/false`).

## Rationale{% #rationale %}

If the Group Identifier (GID) of a local interactive users home directory is not the same as the primary GID of the user, this would allow unauthorized access to the users files, and users that share the same group may not be able to access files that they legitimately should.

## Remediation{% #remediation %}

### Shell script{% #shell-script %}

The following script can be run on the host to remediate the issue.

```bash
#!/bin/bash

# Get interactive users using getent to support remote users (LDAP, SSSD, etc.)
while IFS=: read -r _ _ uid gid _ home shell; do
    # Filter interactive users: UID >= 1000, not nobody, has valid home dir, not nologin/false shell
    if [ "$uid" -ge 1000 ] && [ "$uid" -ne 65534 ] && \
       [ "$home" != "/" ] && \
       [ "$shell" != "/sbin/nologin" ] && [ "$shell" != "/usr/sbin/nologin" ] && \
       [ "$shell" != "/bin/false" ] && [ "$shell" != "/usr/bin/false" ]; then
        # Arguments are properly quoted to prevent command injection
        chgrp -f -- "$gid" "$home"
    fi
done < <(getent passwd)
```

### Ansible playbook{% #ansible-playbook %}

The following playbook can be run with Ansible to remediate the issue.

```gdscript3
- name: Get all users from getent to support remote users (LDAP, SSSD, etc.)
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create interactive_users variable filtering out non-interactive shells
  ansible.builtin.set_fact:
    interactive_users: '{{ ansible_facts.getent_passwd|dict2items|rejectattr("value.5",
      "match", ".*/sbin/nologin$")|rejectattr("value.5", "match", ".*/usr/sbin/nologin$")|rejectattr("value.5",
      "match", ".*/bin/false$")|rejectattr("value.5", "match", ".*/usr/bin/false$")|list
      }}'
  tags:
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence of home directories to avoid creating them, but only fixing
    group ownership
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ interactive_users }}'
  when:
  - item.value[1]|int >= 1000
  - item.value[1]|int != 65534
  - item.value[4] != "/"
  tags:
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive users are the group-owners of their respective home directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    group: '{{ item.0.value[2] }}'
  loop: '{{ interactive_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy
```

## Warning{% #warning %}

Due to OVAL limitation, this rule can report a false negative in a specific situation where two interactive users swap the group-ownership of their respective home directories.