Ensure All Files Are Owned by a Group


If any files are not owned by a group, then the cause of their lack of group-ownership should be investigated. Following this, the files should be deleted or assigned to an appropriate group. The following command will discover and print any files on local partitions which do not belong to a valid group:

$ df --local -P | awk '{if (NR!=1) print $6}' | sudo xargs -I '{}' find '{}' -xdev -nogroup

To search all filesystems on a system including network mounted filesystems the following command can be run manually for each partition:

$ sudo find PARTITION -xdev -nogroup


Unowned files do not directly imply a security problem, but they are generally a sign that something is amiss. They may be caused by an intruder, by incorrect software installation or draft software removal, or by failure to remove all files belonging to a deleted account. The files should be repaired so they will not cause problems when accounts are created in the future, and the cause should be discovered and addressed.


This rule only considers local groups. If you have your groups defined outside /etc/group, the rule won’t consider those.