All Interactive User Home Directories Must Be Group-Owned By The Primary Group

An XCCDF Rule

Description

Change the group owner of interactive users home directory to the group found in /etc/passwd. To change the group owner of interactive users home directory, use the following command:

$ sudo chgrp USER_GROUP /home/USER

This rule ensures every home directory related to an interactive user is group-owned by an interactive user. It also ensures that interactive users are group-owners of one and only one home directory.

warning alert: Warning

Due to OVAL limitation, this rule can report a false negative in a specific situation where two interactive users swap the group-ownership of their respective home directories.

Rationale

If the Group Identifier (GID) of a local interactive users home directory is not the same as the primary GID of the user, this would allow unauthorized access to the users files, and users that share the same group may not be able to access files that they legitimately should.

ID: xccdf_org.ssgproject.content_rule_file_groupownership_home_directories
Severity: Medium
References: CCI-000366

CM-6(b) CM-6.1(iv)

SRG-OS-000480-GPOS-00227

SLES-15-040100

6.2.7

SV-234994r622137_rule

CCE-85711-0
Updated: about 1 year ago


awk -F':' '{ if ($3 >= 1000 && $3 != 65534) system("chgrp -f " $4" "$6) }' /etc/passwd

- name: Get all local users from /etc/passwd
  ansible.builtin.getent:
    database: passwd
    split: ':'
  tags:
  - CCE-85711-0  - DISA-STIG-SLES-15-040100
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Create local_users variable from the getent output
  ansible.builtin.set_fact:
    local_users: '{{ ansible_facts.getent_passwd|dict2items }}'
  tags:
  - CCE-85711-0
  - DISA-STIG-SLES-15-040100
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Test for existence of home directories to avoid creating them, but only fixing
    group ownership
  ansible.builtin.stat:
    path: '{{ item.value[4] }}'
  register: path_exists
  loop: '{{ local_users }}'
  when:
  - item.value[1]|int >= 1000
  - item.value[1]|int != 65534
  tags:
  - CCE-85711-0
  - DISA-STIG-SLES-15-040100
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Ensure interactive local users are the group-owners of their respective home
    directories
  ansible.builtin.file:
    path: '{{ item.0.value[4] }}'
    group: '{{ item.0.value[2] }}'
  loop: '{{ local_users|zip(path_exists.results)|list }}'
  when: item.1.stat is defined and item.1.stat.exists
  tags:
  - CCE-85711-0
  - DISA-STIG-SLES-15-040100
  - NIST-800-53-CM-6(b)
  - NIST-800-53-CM-6.1(iv)
  - file_groupownership_home_directories
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

All Interactive User Home Directories Must Be Group-Owned By The Primary Group

Description

Rationale

Remediation - Shell Script

Remediation - Ansible