Verify User Who Owns /var/log/messages File
Ensures the general system log /var/log/messages is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
Why this rule matters
/var/log/messages is the primary general system log on RHEL-family systems, recording kernel messages, service events and errors. If it is not owned by root (UID 0), an unprivileged or compromised process could read sensitive operational details or alter/delete entries, hiding signs of a fault or an intrusion and undermining incident analysis.
What Pavois checks
Pavois checks that the owner UID of /var/log/messages is 0 (root) when the file exists (only_if), since this log is RHEL-specific. It reads the live filesystem owner (stat) on the target rather than a packaging default, so a chown from log rotation or a deployment tool is reported as the effective on-disk state.
only_if { file('/var/log/messages').exist? }
describe command("stat -c %U /var/log/messages 2>/dev/null") do
its('stdout.strip') { should be_in ['root', 'root'] }
endHow to verify it is applied
Confirm the owner with:
stat -c '%U %u' /var/log/messages
Expected output is root 0.
Inspect & investigate
This file is itself the main system log. Inspect ownership and content:
ls -l /var/log/messages
tail -n 50 /var/log/messages
The writer is rsyslog (systemctl status rsyslog). Ownership changes can be tracked with grep 'messages' /var/log/audit/audit.log if auditd watches are configured.
Remediation
No automated remediation plan is defined, so this rule must be applied manually. Restore root ownership with:
chown root /var/log/messages
(pavois harden apply will not change this file until a remediation resource is added.)
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | chown root /var/log/messages 2>/dev/null; true |
|---|---|
| name | log-owner-var-log-messages |
| not_if | stat -c %U /var/log/messages 2>/dev/null | grep -qxE 'root|root' |
| path | /var/log/messages |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Consequences if misconfigured: a non-root owner can read operational data or tamper with the main system log, hiding faults or intrusions on RHEL-family hosts.
Precautions before applying: re-owning to root is safe, on RHEL, rsyslog writes /var/log/messages as root by default, so the fix matches the expected runtime owner and does not interrupt logging. The only_if guard skips hosts where the file is absent.