documentation_complete: true


title: 'Verify Group Who Owns cron.deny'

description: |-
    {{{ describe_file_group_owner(file="/etc/cron.deny", group="root") }}}

rationale: |-
    Service configuration files enable or disable features of their respective services that if configured incorrectly
    can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
    correct group to prevent unauthorized changes.

severity: medium

identifiers:
    cce@rhel9: CCE-86537-8
    cce@rhel10: CCE-88060-9

references:
    nist: CM-6 b
    srg: SRG-OS-000480-GPOS-00227

ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/cron.deny", group="root") }}}'

ocil: |-
    {{{ ocil_file_group_owner(file="/etc/cron.deny", group="root") }}}

fixtext: '{{{ fixtext_file_group_owner(file="/etc/cron.deny/", group="root") }}}'

srg_requirement: '{{{ srg_requirement_file_group_owner(file="/etc/cron.deny", group="root") }}}'

template:
    name: file_groupowner
    vars:
        filepath: /etc/cron.deny
        gid_or_name: '0'
