Verify Group Who Owns /var/log/localmessages* File
Ensures the /var/log/localmessages log file is owned by the adm group.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/localmessages* file holds log messages from certain boot scripts, including the DHCP client. Read access must be restricted to authorized personnel: log files frequently leak hostnames, IP addresses, service versions and error traces that help an attacker map the system and find weaknesses.
What Pavois checks
Pavois reads the file's effective owning group via the InSpec file resource and asserts it is adm, only when the file exists. Inspecting the live filesystem metadata (not a packaging manifest or a config template) reflects what permissions the system actually enforces right now, including changes made by log-rotation, ad-hoc chgrp, or a misbehaving service.
only_if { file('/var/log/localmessages').exist? }
describe file('/var/log/localmessages') do
its('group') { should eq 'adm' }
endHow to verify it is applied
Run stat -c '%G' /var/log/localmessages. Expected output: adm. You can also use ls -l /var/log/localmessages and confirm the group column reads adm.
Inspect & investigate
Ownership changes are visible with ls -l /var/log/localmessages and stat /var/log/localmessages. If auditd is configured to watch /var/log, the related chgrp/chown syscalls appear in /var/log/audit/audit.log. The rsyslog rule that creates this file lives under /etc/rsyslog.d/ (check with journalctl -u rsyslog).
Remediation
Pavois's harden plan uses the file resource to set the owning group of /var/log/localmessages to adm (equivalent to chgrp adm /var/log/localmessages). Apply it with pavois harden apply; no service restart is involved.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | adm |
|---|---|
| path | /var/log/localmessages |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If the group is wrong, members of an over-privileged or default group can read boot/DHCP logs and harvest reconnaissance data. Changing the owning group is low-risk: tools that read the file via root or via the adm group are unaffected. Precaution: confirm no custom log-processing service runs under a different group that relies on the previous ownership before applying.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.