the actual /home dir should be world readable I think, there for should be included in the permission checks.
diff --git a/RHEL/6/input/checks/file_permissions_home_dirs.xml b/RHEL/6/input/checks/file_permissions_home_dirs.xml index e0d671f..e9757a8 100644 --- a/RHEL/6/input/checks/file_permissions_home_dirs.xml +++ b/RHEL/6/input/checks/file_permissions_home_dirs.xml @@ -16,8 +16,8 @@ <unix:state state_ref="state_home_dirs_wrong_perm" /> </unix:file_test> <unix:file_object comment="home directories" id="object_file_permissions_home_dirs" version="1"> - <unix:behaviors recurse="directories" recurse_direction="down" max_depth="1" recurse_file_system="all" /> - <unix:path operation="equals">/home</unix:path> + <unix:behaviors recurse="directories" recurse_direction="down" max_depth="0" recurse_file_system="all" /> + <unix:path operation="pattern match">^/home/[^/]*$</unix:path> <unix:filename xsi:nil="true" /> <filter action="include">state_home_dirs_wrong_perm</filter> </unix:file_object>
scap-security-guide@lists.fedorahosted.org