Verify Group Who Owns /var/log/waagent.log File
Ensures the /var/log/waagent.log Azure agent log is owned by the adm group.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/waagent.log file records events from the Azure Linux Guest Agent, useful for troubleshooting but also containing provisioning details, endpoint URLs and host metadata. It must be restricted to the adm group so only authorized personnel can read it; otherwise it leaks cloud-provisioning context that aids an attacker.
What Pavois checks
Pavois reads the file's effective owning group with the InSpec file resource and asserts it is adm, only when the file exists (the agent is present only on Azure VMs). Reading live filesystem metadata reflects the permissions enforced right now, catching drift from rotation or manual changes a static scan would miss.
only_if { file('/var/log/waagent.log').exist? }
describe file('/var/log/waagent.log') do
its('group') { should eq 'adm' }
endHow to verify it is applied
Run stat -c '%G' /var/log/waagent.log. Expected output: adm. Alternatively ls -l /var/log/waagent.log should show adm in the group column.
Inspect & investigate
Ownership is shown by ls -l /var/log/waagent.log and stat /var/log/waagent.log. The file is written by the Azure agent, check systemctl status walinuxagent (or waagent) and journalctl -u walinuxagent. If auditd watches /var/log, ownership-change syscalls appear in /var/log/audit/audit.log.
Remediation
Pavois's harden plan uses the file resource to set the owning group of /var/log/waagent.log to adm (equivalent to chgrp adm /var/log/waagent.log). Apply it with pavois harden apply; no service restart is required.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | adm |
|---|---|
| path | /var/log/waagent.log |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If the group is wrong, unprivileged users can read Azure provisioning logs and harvest cloud-context intelligence. Setting the group to adm is low-risk because the Azure agent runs as root. Precaution: this control only matters on Azure VMs; on other platforms the file is absent and the check is skipped. Confirm no custom tooling reads the log under a different group before applying.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.