documentation_complete: true


title: 'User Initialization Files Must Be Group-Owned By The Primary Group'

description: |-
    Change the group owner of interactive users files to the group found
    in <pre>/etc/passwd</pre> for the user. To change the group owner of a local
    interactive user home directory, use the following command:
    <pre>$ sudo chgrp <i>USER_GROUP</i> /home/<i>USER</i>/.<i>INIT_FILE</i></pre>

    This rule ensures every initialization file related to an interactive user
    is group-owned by an interactive user.

rationale: |-
    Local initialization files for interactive users are used to configure the
    user's shell environment upon logon. Malicious modification of these files could
    compromise accounts upon logon.

severity: medium

identifiers:
    cce@rhel8: CCE-86314-2
    cce@rhel9: CCE-87037-8
    cce@rhel10: CCE-89225-7
    cce@sle12: CCE-92295-5
    cce@sle15: CCE-91408-5

references:
    cis@sle12: 6.2.8
    cis@sle15: 6.2.8
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol7: OL07-00-020700

ocil_clause: 'they are not'

ocil: |-
    To verify the local initialization files of all local interactive users are group-
    owned by the appropriate user, inspect the primary group of the respective
    users in <tt>/etc/passwd</tt> and verify all initialization files under the
    respective users home directory. Check the group owner of all local interactive users
    initialization files.

warnings:
    - general: |-
       Due to OVAL limitation, this rule can report a false negative in a
       specific situation where two interactive users swap the group-ownership
       of their respective initialization files.

platform: system_with_kernel
