{
  "id": "CB-UBU-FS-009",
  "standard": "ubuntu",
  "version": "0.1.1",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-FS-009",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-FS-009.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-FS-009.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-FS-009",
    "title": "Leave no file without a known owner or group",
    "finding": {
      "title": "Some files belong to a user or group that does not exist",
      "description": "An account created later with the same ID would silently own these files."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "automated",
    "tags": [
      "permissions",
      "ownership"
    ],
    "description": "Every file and directory on local filesystems (ext2/3/4, XFS, Btrfs, JFS, F2FS, FAT, exFAT and\ntmpfs) belongs to a user and a group that exist in the account databases.\n",
    "rationale": "Orphaned files usually come from deleted accounts or from archives extracted with their original\nIDs. The next account or group created with that numeric ID becomes their owner and can read or\nchange them. They also point to incomplete account clean-up.\n",
    "impact": "None: the control only reports.\n",
    "notes": "The scan stays on each filesystem (`find -xdev`). Network filesystems are not scanned: their IDs\ncome from another system.\n",
    "audit": {
      "manual": "For each local filesystem listed by `findmnt -knr -o TARGET -t ext2,ext3,ext4,xfs,btrfs,jfs,f2fs,vfat,exfat,tmpfs`, run\n`find <mount point> -xdev \\( -nouser -o -nogroup \\)`. The command must print nothing.\n",
      "checks": [
        {
          "id": "unowned",
          "engine": "shell",
          "description": "Files and directories without a known owner or group on local filesystems.",
          "spec": {
            "script": "out=$(for m in $(findmnt -knr -o TARGET -t ext2,ext3,ext4,xfs,btrfs,jfs,f2fs,vfat,exfat,tmpfs); do\n  find \"$m\" -xdev \\( -nouser -o -nogroup \\) -print 2>/dev/null\ndone | sort -u)\n[ -z \"$out\" ] && { echo \"every file has a known owner and group\"; exit 0; }\necho \"$(printf '%s\\n' \"$out\" | wc -l) item(s):\"\nprintf '%s\\n' \"$out\" | head -n 20 | while IFS= read -r f; do stat -c '%n %u:%g' \"$f\"; done\nexit 1\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "For each reported item, find where it comes from (`ls -ln`, `dpkg -S`), then:\n- give it to its current owner with `chown <user>:<group> <file>`;\n- or delete it if it belonged to a removed account and is no longer needed.\n\nRestore files from archives with `tar --no-same-owner` (default for non-root) or fix the\nowner right after extraction.\n"
    },
    "references": [
      {
        "title": "find(1), Ubuntu manual pages (-nouser, -nogroup)",
        "url": "https://manpages.ubuntu.com/manpages/noble/man1/find.1.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R53)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R53",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "cwe",
        "id": "CWE-283"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-AUTH-023",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM 2520, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Passes on fresh install; file with unknown UID/GID detected."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM 2522, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Passes on fresh install; file with unknown UID/GID detected."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM 2524, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Passes on fresh install; file with unknown UID/GID detected."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM 2526, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Passes on fresh install; file with unknown UID/GID detected."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}