mediumaccess-controlverified ✓rollback-safe

Set local interactive user home directory permissions to 0750 or less

home-dir-permissions · RHEL ≥ 8 · 1 impl

Description

All RHEL 8 local interactive user home directories must have mode 0750 or less permissive. Home directory permissions that are too permissive allow other users to read, write, or access files in those directories.

Rationale

Group-readable or world-readable home directories allow unauthorized access to user files. Restricting home directory permissions to 0750 or less ensures only the owner and their primary group can access the directory.

Check → Remediate

Checkcommand

bad=$(awk -F: '$3 >= 1000 && $3 < 65534 && $7 != "/sbin/nologin" && $7 != "/bin/false" && $7 != "" {print $6}' \
  /etc/passwd 2>/dev/null |
  while read hd; do
    [ -d "$hd" ] || continue
    mode=$(stat -c "%a" "$hd" 2>/dev/null)
    [ $(( 0$mode & 027 )) -ne 0 ] && echo "$hd ($mode)"
  done)
[ -z "$bad" ]

expected_exit:: 0

Remediatefile_permissions

find_paths:: /home
find_type:: d
find_args:: -maxdepth 1 -mindepth 1 -perm /027
mode:: 0750

Framework references

STIG

V-281065 / RHEL-10-400240V-257890 / RHEL-09-232050V-230321

NIST 800-53

CM-6AC-6

Live verification

rhel8:check

#home-directory#permissions#file-security#users