Verify Group Who Owns /var/log/cloud-init.log* File
Ensures the /var/log/cloud-init logs are group-owned by adm so first-boot provisioning details stay confidential.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/cloud-init logs capture the full first-boot provisioning: user-data, network and SSH key setup, and sometimes injected credentials or metadata-server tokens. If a non-privileged group can read them, secrets and bootstrap details leak. Restricting them to the adm group keeps provisioning telemetry confidential.
What Pavois checks
Pavois reads the resolved group ownership of /var/log/cloud-init via the InSpec file resource and asserts the group is adm. It inspects the live inode metadata, so it reflects the directory's actual state on disk after provisioning, not a packaged default.
only_if { file('/var/log/cloud-init.log').exist? }
describe file('/var/log/cloud-init.log') do
its('group') { should eq 'adm' }
endHow to verify it is applied
Run stat -c '%G' /var/log/cloud-init. The expected output is:
adm
Also check the log files with ls -l /var/log/cloud-init.log /var/log/cloud-init-output.log.
Inspect & investigate
These are cloud-init's own logs: review /var/log/cloud-init.log and /var/log/cloud-init-output.log, or run cloud-init status --long and cloud-init analyze show. To trace permission changes, add an auditd watch (auditctl -w /var/log/cloud-init -p wa -k logperms) and grep /var/log/audit/audit.log for key="logperms".
Remediation
Pavois's harden plan applies the file resource to set the group of /var/log/cloud-init to adm. It is applied with pavois harden apply and leaves the owner and permission bits untouched.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | adm |
|---|---|
| path | /var/log/cloud-init.log |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Wrong group ownership can leak provisioning secrets (injected passwords, keys, cloud-metadata tokens) to unprivileged users. The fix only changes group ownership and does not affect a running system, since cloud-init has already completed by audit time. Precaution: if cloud-init re-runs on a later boot (e.g. after a clean), confirm it recreates the logs with an acceptable group; consider also tightening read bits, as group ownership alone does not stop world-readable access.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.