STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must ensure that all local interactive user home directories are group-owned by the home directory owner's primary group.

DISA Rule

SV-281049r1197223_rule

Vulnerability Number

V-281049

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

RHEL-10-400160

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure RHEL 10 interactive users' home directories to be group-owned by the user's primary GID.

Change the group owner of a local interactive user's home directory to the group found in "/etc/passwd". To change the group owner of a local interactive user's home directory, use the following command:

Note: The example will be for the user "disauser", who has a home directory of "/home/disauser" and has a primary group of users.

$ sudo chgrp users /home/disauser

Check Contents

Verify RHEL 10 interactive users' home directories are group-owned by the user's primary GID with the following command:

Note: This may miss local interactive users that have been assigned a privileged user identifier (UID). Evidence of interactive use may be obtained from several log files containing system login information. The returned directory "/home/disauser" is used as an example.

$ sudo ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)
drwxr-x--- 2 disauser admin 4096 Jun 5 12:41 disauser

Check the user's primary group with the following command:

$ sudo grep $(grep disauser /etc/passwd | awk -F: '{print $4}') /etc/group
admin:x:250:disauser,doduser,nsauser

If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID, this is a finding.

Vulnerability Number

V-281049

Documentable

False

Rule Version

RHEL-10-400160

Severity Override Guidance

Verify RHEL 10 interactive users' home directories are group-owned by the user's primary GID with the following command:

Note: This may miss local interactive users that have been assigned a privileged user identifier (UID). Evidence of interactive use may be obtained from several log files containing system login information. The returned directory "/home/disauser" is used as an example.

$ sudo ls -ld $(awk -F: '($3>=1000)&&($7 !~ /nologin/){print $6}' /etc/passwd)
drwxr-x--- 2 disauser admin 4096 Jun 5 12:41 disauser

Check the user's primary group with the following command:

$ sudo grep $(grep disauser /etc/passwd | awk -F: '{print $4}') /etc/group
admin:x:250:disauser,doduser,nsauser

If the user home directory referenced in "/etc/passwd" is not group-owned by that user's primary GID, this is a finding.

Check Content Reference

M

Target Key

5733