Verify Groupownership of Files in /var/log/apt
Ensures the /var/log/apt directory is group-owned by adm so package-manager logs are readable only by log-privileged accounts.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/apt directory holds the package-manager logs (installs, upgrades, removals). These records reveal exactly which software and versions are present on the host, information an attacker can use to target known vulnerabilities. Restricting the directory to the adm group keeps this inventory away from ordinary users.
What Pavois checks
Pavois reads the resolved group ownership of /var/log/apt via the InSpec file resource and asserts the group is adm. It checks the live inode metadata, not a packaging default or a config snippet, so it reflects the directory's actual state on disk at audit time.
only_if { file('/var/log/apt').exist? }
describe file('/var/log/apt') do
its('group') { should eq 'adm' }
endHow to verify it is applied
Run stat -c '%G' /var/log/apt. The expected output is:
adm
You can inspect the whole tree with ls -ld /var/log/apt and find /var/log/apt -printf '%g %p\n'.
Inspect & investigate
Ownership changes are not logged by APT itself. To audit them, check dpkg.log context with dpkg -V, or add an auditd watch (auditctl -w /var/log/apt -p wa -k logperms) and inspect /var/log/audit/audit.log for key="logperms".
Remediation
Pavois's harden plan applies the file resource to set the group of /var/log/apt to adm. It is applied with pavois harden apply and leaves the owner and permission bits untouched.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | adm |
|---|---|
| path | /var/log/apt |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Misconfiguration leaks the host's software inventory to unprivileged users, aiding reconnaissance. The change is low-risk: only group ownership is altered, and adm is the standard log group on Debian/Ubuntu. Precaution: if a custom log shipper or monitoring agent reads APT logs under a different group, add it to adm or grant it access before applying, so log collection is not interrupted.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.