Title

All files and directories contained in user home directories must not have extended ACLs. (Cat II impact)

Discussion

Excessive permissions allow unauthorized access to user files.

Check Content

Check the contents of interactive user's home directories (99 < UID < 60000) for files with extended ACLs. # ls -alLR < users home dir > If the permissions include a "+", the file has an extended ACL and this is a finding.

Fix Text

Remove the extended ACL from the file. # chmod A- [user file with extended ACL]

Additional Identifiers

Rule ID: SV-227661r603266_rule

Vulnerability ID: V-227661

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.