Verify Owner on the journalctl Command
Ensures the journalctl binary (/usr/bin/journalctl) is owned by root (uid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
journalctl is the tool used to read the systemd journal, which holds operational, error and security-relevant events. If the binary is owned by a non-root user, that user could replace or tamper with it to hide log entries, leak sensitive information (PII, operational details exposed in error messages) to unauthorized people, or run trojaned code with the privileges of whoever invokes it. Keeping the binary owned by root (uid 0) ensures only the superuser can modify the audit-viewing tooling.
What Pavois checks
Pavois asserts that the live file /usr/bin/journalctl has owner uid 0, skipping the test via only_if if the binary is absent. It reads the effective owner from the filesystem (stat) rather than trusting the package database, so even if dpkg -V systemd reports no change, a binary that was manually replaced or re-owned is still flagged.
only_if { file('/usr/bin/journalctl').exist? }
describe file('/usr/bin/journalctl') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /usr/bin/journalctl. Expected output: root 0. Equivalently, ls -l /usr/bin/journalctl should show root as the owner.
Inspect & investigate
Ownership has no running log; check current state with stat /usr/bin/journalctl. Use of the journal tooling itself is visible via journalctl, and if /usr/bin is watched by auditd, tampering with the binary shows up in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined, so apply it manually: chown root:root /usr/bin/journalctl. Reinstalling the systemd package (apt install --reinstall systemd) also restores the correct root ownership.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /usr/bin/journalctl |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner of this binary is a serious risk: that user controls the tool everyone uses to read logs and could trojan it. Restoring root ownership is safe and does not affect normal users' ability to run journalctl (read access is governed by group membership and permissions, not ownership). Precaution: do not strip the setgid bit or change group ownership while fixing the owner, as journalctl relies on group systemd-journal semantics on some setups.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| DISA STIG | UBTU-22-232100, UBTU-24-700040 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.