mediumaccess-controlverified ✓

Ensure local interactive user home directories are group-owned by the user's primary group

user-home-directory-group-owner · RHEL ≥ 8 · 1 impl

Description

All local interactive user home directories must be group-owned by the home directory owner's primary group.

Rationale

If a home directory is group-owned by a different group than the user's primary group, other group members may have unintended access to the user's files, creating a confidentiality risk.

Check → Remediate

Checkcommand

# Check home directories are group-owned by user's primary group
bad_dirs=""
while IFS=: read -r user _ uid gid _ home _; do
  if [ "$uid" -ge 1000 ] 2>/dev/null && [ -d "$home" ]; then
    dir_gid=$(stat -c '%g' "$home" 2>/dev/null)
    if [ -n "$dir_gid" ] && [ "$dir_gid" != "$gid" ]; then
      bad_dirs="$bad_dirs $user:$home(dir_gid=$dir_gid,user_gid=$gid)"
    fi
  fi
done < /etc/passwd
if [ -z "$bad_dirs" ]; then
  echo "OK: All home directories are group-owned by the user's primary group"
  exit 0
fi
echo "FAIL: Home directories with wrong group ownership:$bad_dirs"
exit 1

expected_exit:: 0

Remediatemanual

note:: For each home directory with incorrect group ownership, use: chgrp <primary_group> /home/<username>

Framework references

STIG

V-281049 / RHEL-10-400160V-258053 / RHEL-09-411070V-230322

NIST 800-53

AC-6CM-6

Live verification

rhel8:checkrhel9:check

#user-accounts#home-directory#permissions#group-ownership