Title

All RHEL 8 local interactive user home directory files must have mode 0750 or less permissive. (Cat II impact)

Discussion

Excessive permissions on local interactive user home directories may allow unauthorized access to user files by other users.

Check Content

Verify all files and directories contained in a local interactive user home directory, excluding local initialization files, have a mode of "0750". Files that begin with a "." are excluded from this requirement. Note: The example will be for the user "smithj", who has a home directory of "/home/smithj". $ sudo ls -lLR /home/smithj -rwxr-x--- 1 smithj smithj 18 Mar 5 17:06 file1 -rwxr----- 1 smithj smithj 193 Mar 5 17:06 file2 -rw-r-x--- 1 smithj smithj 231 Mar 5 17:06 file3 If any files or directories are found with a mode more permissive than "0750", this is a finding.

Fix Text

Set the mode on files and directories in the local interactive user home directory with the following command: Note: The example will be for the user smithj, who has a home directory of "/home/smithj" and is a member of the users group. $ sudo chmod 0750 /home/smithj/<file or directory>

Additional Identifiers

Rule ID: SV-244531r1017338_rule

Vulnerability ID: V-244531

Group Title: SRG-OS-000480-GPOS-00227

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.