Verify User Who Owns /var/log/cloud-init.log File
Ensures the cloud-init log directory/file /var/log/cloud-init is owned by the syslog user.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The cloud-init log records detailed provisioning and debugging information, instance metadata, network setup, and sometimes injected user-data such as bootstrap scripts or temporary credentials. If it is not owned by syslog, an unprivileged user could read secrets that leaked into the provisioning trace, or tamper with the log to hide how a freshly provisioned instance was configured or compromised.
What Pavois checks
Pavois checks that the owner of /var/log/cloud-init is syslog, only when the path exists (only_if), since cloud-init is present mainly on cloud images. It reads the live filesystem owner (stat) on the target rather than a default from the cloud-init package, so the result reflects the real state after any rotation or first-boot provisioning that may have rewritten ownership.
only_if { file('/var/log/cloud-init.log').exist? }
describe command("stat -c %U /var/log/cloud-init.log 2>/dev/null") do
its('stdout.strip') { should be_in ['root', 'syslog'] }
endHow to verify it is applied
Confirm the owner with:
stat -c '%U' /var/log/cloud-init
Expected output is syslog.
Inspect & investigate
Inspect ownership and the provisioning trace directly:
ls -l /var/log/cloud-init.log /var/log/cloud-init/
tail -n 50 /var/log/cloud-init.log
The cloud-init service status is shown by cloud-init status and systemctl status cloud-init. Ownership changes can be tracked with grep 'cloud-init' /var/log/audit/audit.log if auditd file-watches are configured.
Remediation
Pavois's harden plan uses a file resource to set the owner of /var/log/cloud-init to syslog. Run pavois harden apply to enforce it, the Chef engine performs the equivalent of chown syslog /var/log/cloud-init, leaving content and group untouched.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | chown root /var/log/cloud-init.log 2>/dev/null; true |
|---|---|
| name | log-owner-var-log-cloud-init.log |
| not_if | stat -c %U /var/log/cloud-init.log 2>/dev/null | grep -qxE 'root|syslog' |
| path | /var/log/cloud-init.log |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Consequences if misconfigured: secrets injected during provisioning may be readable by non-privileged users, and the provisioning trail can be altered to hide tampering on a new instance.
Precautions before applying: the change is low-risk, cloud-init runs early as root and does not depend on this owner at runtime. Verify the syslog user exists before applying. On hosts where cloud-init is absent the only_if guard skips the rule, so applying it never creates spurious files.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.