Leave no file without a known owner or group

Description

Every file and directory on local filesystems (ext2/3/4, XFS, Btrfs, JFS, F2FS, FAT, exFAT and tmpfs) belongs to a user and a group that exist in the account databases.

The scan stays on each filesystem (find -xdev). Network filesystems are not scanned: their IDs come from another system.

Rationale

Orphaned files usually come from deleted accounts or from archives extracted with their original IDs. The next account or group created with that numeric ID becomes their owner and can read or change them. They also point to incomplete account clean-up.

Impact

None: the control only reports.

Audit

For each local filesystem listed by findmnt -knr -o TARGET -t ext2,ext3,ext4,xfs,btrfs,jfs,f2fs,vfat,exfat,tmpfs, run find <mount point> -xdev \( -nouser -o -nogroup \). The command must print nothing.

Automated: every check must pass. Scanners report each check by its id.

unowned

Files and directories without a known owner or group on local filesystems.

script: |
  out=$(for m in $(findmnt -knr -o TARGET -t ext2,ext3,ext4,xfs,btrfs,jfs,f2fs,vfat,exfat,tmpfs); do
    find "$m" -xdev \( -nouser -o -nogroup \) -print 2>/dev/null
  done | sort -u)
  [ -z "$out" ] && { echo "every file has a known owner and group"; exit 0; }
  echo "$(printf '%s\n' "$out" | wc -l) item(s):"
  printf '%s\n' "$out" | head -n 20 | while IFS= read -r f; do stat -c '%n %u:%g' "$f"; done
  exit 1

Remediation

For each reported item, find where it comes from (ls -ln, dpkg -S), then:

• give it to its current owner with chown <user>:<group> <file>;
• or delete it if it belonged to a removed account and is no longer needed.

Restore files from archives with tar --no-same-owner (default for non-root) or fix the owner right after extraction.

References

• find(1), Debian manual pages (-nouser, -nogroup) Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R53) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUTH-023 Disable accounts that are no longer used

People and lifecycle