Verify Groupowner on the journalctl command
Ensures the /usr/bin/journalctl log-viewer binary is owned by group root (gid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
journalctl reads the systemd journal, which holds error messages, service output and potentially personally identifiable information (PII). Only authorized personnel should see those details, since error messages reveal the operational state and can fingerprint the OS or platform. If the journalctl binary is group-owned by a non-privileged group, a member could replace it with a trojaned version that exfiltrates or hides log data. Group ownership by root (gid 0) keeps the audit-viewing tool trustworthy.
What Pavois checks
Pavois reads the real group id of /usr/bin/journalctl via InSpec's file resource and asserts gid == 0. It verifies the effective ownership of the binary actually installed on disk, so a tampered or repackaged binary with a loosened group is detected, unlike a check that trusts the package database.
only_if { file('/usr/bin/journalctl').exist? }
describe file('/usr/bin/journalctl') do
its('gid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%G %g' /usr/bin/journalctl. Expected output: root 0.
Inspect & investigate
Confirm the package-owned ownership with dpkg -V systemd | grep journalctl (empty means no integrity drift). Add an auditd watch (auditctl -w /usr/bin/journalctl -p wa -k audit_tools) to record changes in /var/log/audit/audit.log.
Remediation
No automated remediation is wired for this rule, so it must be applied manually: chgrp 0 /usr/bin/journalctl. Re-run pavois harden verify afterwards.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /usr/bin/journalctl |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A loosely-owned journalctl could be swapped for a trojaned binary that tampers with or hides logs. Resetting the group to root is safe, any user may still run journalctl, but only privileged accounts (or members of the systemd-journal group) see the full journal. No functional change for ordinary use. Precaution: keep the mode at 0755; do not change the unrelated systemd-journal group membership, which governs read access, not file ownership.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| DISA STIG | UBTU-22-232105, UBTU-24-700050 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.