cis-ubuntu1804-v220-6-1-11

name	cis-ubuntu1804-v220-6-1-11
description	Ensure no files or directories without an owner and a group exist
category	cis-iam
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","file-permissions"]
cis_id	6.1.11
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

6.1.11 Ensure no files or directories without an owner and a group exist (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

Administrators may delete users or groups from the system and neglect to remove all files and/or directories owned by those users or groups.

Rationale

A new user or group who is assigned a deleted user's user ID or group ID may then end up "owning" a deleted user or group's files, and thus have more access on the system than was intended.

Audit Procedure

Command Line

Run the following script to verify no unowned or ungrouped files or directories exist:

#!/usr/bin/env bash

{
    l_output="" l_output2=""
    a_nouser=(); a_nogroup=() # Initialize arrays
    a_path=(! -path "/run/user/*" -a ! -path "/proc/*" -a ! -path "*/containerd/*" -a ! -path "*/kubelet/pods/*" -a ! -path "*/kubelet/plugins/*" -a ! -path "/sys/fs/cgroup/memory/*" -a ! -path "/var/*/private/*")
    while IFS= read -r l_mount; do
        while IFS= read -r -d $'\0' l_file; do
            if [ -e "$l_file" ]; then
                while IFS= read -r l_user l_group; do
                    [ "$l_user" = "UNKNOWN" ] && a_nouser+=("$l_file")
                    [ "$l_group" = "UNKNOWN" ] && a_nogroup+=("$l_file")
                 < <( -Lc  )
            
         < <(find  -xdev \(  \) \( - f -o - d \) \( -nouser -o -nogroup \) -print0 2> /dev/null)
     < <(findmnt -Dkerno fstype,target | awk )
     ! ((  >  )); 
        l_output=
    
        l_output2=
    
     ! ((  >  )); 
        l_output=
    
        l_output2=
    
     a_path;  a_arr;  a_nouser;  a_nogroup 
     [ -z  ]; 
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}