Verify User Who Owns /var/log/localmessages File
Ensures /var/log/localmessages (local syslog facilities) is owned by the syslog user.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/log/localmessages collects messages from the local syslog facilities (local0:local7), used by boot scripts, the DHCP client and many third-party services. If it is not owned by syslog, an unprivileged or compromised process could alter or delete these records, masking the activity of the services that log there and weakening the system's audit trail.
What Pavois checks
Pavois checks that the owner of /var/log/localmessages is syslog, only when the file exists (only_if). It reads the live owner (stat) on the target, not a logrotate template, so a chown introduced by rotation, a packaging hook or a buggy service is detected as the effective on-disk state.
only_if { file('/var/log/localmessages').exist? }
describe command("stat -c %U /var/log/localmessages 2>/dev/null") do
its('stdout.strip') { should be_in ['root', 'syslog'] }
endHow to verify it is applied
Confirm the owner with:
stat -c '%U' /var/log/localmessages
Expected output is syslog.
Inspect & investigate
This file is itself a log. Inspect ownership and content:
ls -l /var/log/localmessages
tail -n 50 /var/log/localmessages
The writer is rsyslog (systemctl status rsyslog). Ownership changes can be tracked with grep 'localmessages' /var/log/audit/audit.log if auditd watches are configured.
Remediation
Pavois's harden plan uses a file resource to set the owner of /var/log/localmessages to syslog. Run pavois harden apply to enforce it, the Chef engine performs the equivalent of chown syslog /var/log/localmessages, leaving content and group untouched.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | chown root /var/log/localmessages 2>/dev/null; true |
|---|---|
| name | log-owner-var-log-localmessages |
| not_if | stat -c %U /var/log/localmessages 2>/dev/null | grep -qxE 'root|syslog' |
| path | /var/log/localmessages |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Consequences if misconfigured: wrong ownership lets a non-logging process tamper with messages from boot scripts and local services, hiding their activity.
Precautions before applying: the change is safe, rsyslog runs as syslog and keeps writing normally. Ensure the syslog user exists; the only_if guard skips hosts without this file (it is created by an rsyslog rule that not all distros ship), so the fix is inert where it does not apply.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.