Verify Groupownership of Files in /var/log/landscape
Ensures the /var/log/landscape directory is group-owned by root so Landscape management logs are restricted to privileged accounts.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/landscape directory holds logs of the Landscape management client, which orchestrates system administration tasks on Ubuntu fleets. These logs can reveal management endpoints, scheduled actions and host details. Restricting the directory to the root group keeps administrative telemetry away from ordinary users.
What Pavois checks
Pavois reads the resolved group ownership of /var/log/landscape via the InSpec file resource and asserts the group is root. It inspects the live inode metadata, so it reflects the directory's actual state on disk rather than a packaging default.
only_if { file('/var/log/landscape').exist? }
describe file('/var/log/landscape') do
its('group') { should eq 'root' }
endHow to verify it is applied
Run stat -c '%G' /var/log/landscape. The expected output is:
root
Inspect the tree with ls -ld /var/log/landscape and find /var/log/landscape -printf '%g %p\n'.
Inspect & investigate
Ownership changes are not logged by Landscape itself. To audit them, add an auditd watch (auditctl -w /var/log/landscape -p wa -k logperms) and grep /var/log/audit/audit.log for key="logperms".
Remediation
Pavois's harden plan applies the file resource to set the group of /var/log/landscape to root. It is applied with pavois harden apply and leaves the owner and permission bits untouched.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| path | /var/log/landscape |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Misconfiguration exposes Landscape management telemetry to unprivileged users. The change is low-risk: only group ownership is altered to the already-restrictive root group. Precaution: if the landscape service account or a log shipper relies on group read access, confirm it still reads via its owner or another mechanism before applying, so management logging continues uninterrupted.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.2.1, 6.1.4.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.