Verify User Who Owns /var/log Directory
Ensures the system log directory /var/log is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/log is the root of the system log tree. Whoever owns this directory can create, rename or delete the log files it contains, regardless of the permissions on the individual files. If it is not owned by root (UID 0), an attacker could replace a log with a symlink, swap a sensitive log for a world-readable copy, or remove entries wholesale, defeating logging as a control and crippling forensic analysis.
What Pavois checks
Pavois checks that the owner UID of the /var/log directory is 0 (root) when it exists (only_if). It reads the live directory owner (stat) on the target, not a packaging default, so even if a deployment script or container image build re-owned /var/log, the control reports the effective on-disk state.
only_if { file('/var/log').exist? }
describe file('/var/log') do
its('uid') { should eq 0 }
endHow to verify it is applied
Confirm the owner with:
stat -c '%U %u' /var/log
Expected output is root 0.
Inspect & investigate
This is the log directory itself. Inspect ownership directly:
stat /var/log
ls -ld /var/log
Changes to the directory ownership can be tracked with grep ' name="/var/log"' /var/log/audit/audit.log if auditd watches are configured.
Remediation
No automated remediation plan is defined, so this rule must be applied manually. Restore root ownership with:
chown root /var/log
Use chown root /var/log (not -R) to re-own only the directory; log files inside have their own ownership rules. (pavois harden apply will not change this directory until a remediation resource is added.)
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /var/log |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Consequences if misconfigured: a non-root owner of /var/log can delete or replace log files (e.g. symlink attacks), erasing or poisoning the audit trail for the whole system.
Precautions before applying: re-owning the directory to root is safe, system loggers run as root or have their files owned individually. Do not add -R: a recursive chown would override the per-file ownership that other rules require (e.g. syslog-owned logs) and could break log rotation or collection agents. Re-own only the top directory.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| DISA STIG | UBTU-22-232120, UBTU-24-700110 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.