All Interactive User Home Directories Must Be Group-Owned By The Primary Group

Classification:

compliance

Framework:

Control:

Description

Change the group owner of interactive users home directory to the group found in /etc/passwd. To change the group owner of interactive users home directory, use the following command:

$ sudo chgrp *USER\_GROUP* /home/*USER*

This rule ensures every home directory related to an interactive user is group-owned by an interactive user. It also ensures that interactive users are group-owners of one and only one home directory.

Rationale

If the Group Identifier (GID) of a local interactive users home directory is not the same as the primary GID of the user, this would allow unauthorized access to the users files, and users that share the same group may not be able to access files that they legitimately should.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

awk -F':' '{ if ($3 >= 1000 && $3 != 65534) system("chgrp -f " $4" "$6) }' /etc/passwd

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Get all local users from /etc/passwd
 ansible.builtin.getent:
 database: passwd
 split: ':'
 tags:
 - file\_groupownership\_home\_directories
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - restrict\_strategy

- name: Create local\_users variable from the getent output
 ansible.builtin.set\_fact:
 local\_users: '{{ ansible\_facts.getent\_passwd|dict2items }}'
 tags:
 - file\_groupownership\_home\_directories
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - restrict\_strategy

- name: Test for existence of home directories to avoid creating them, but only fixing
 group ownership
 ansible.builtin.stat:
 path: '{{ item.value[4] }}'
 register: path\_exists
 loop: '{{ local\_users }}'
 when:
 - item.value[1]|int >= 1000
 - item.value[1]|int != 65534
 tags:
 - file\_groupownership\_home\_directories
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - restrict\_strategy

- name: Ensure interactive local users are the group-owners of their respective home
 directories
 ansible.builtin.file:
 path: '{{ item.0.value[4] }}'
 group: '{{ item.0.value[2] }}'
 loop: '{{ local\_users|zip(path\_exists.results)|list }}'
 when: item.1.stat is defined and item.1.stat.exists
 tags:
 - file\_groupownership\_home\_directories
 - low\_complexity
 - low\_disruption
 - medium\_severity
 - no\_reboot\_needed
 - restrict\_strategy

Warning

Due to OVAL limitation, this rule can report a false negative in a specific situation where two interactive users swap the group-ownership of their respective home directories.