Verify Ownership of Files in /var/log/apt
Ensures the APT log directory /var/log/apt is owned by root (uid 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/apt directory records what packages were installed, upgraded or removed (history.log, term.log). These logs reveal the exact software inventory and patch level of the host, valuable reconnaissance for an attacker, and form an audit trail of administrative actions. If a non-root user owns this directory, they can read it to map vulnerabilities or rewrite it to erase evidence of a malicious package install. Keeping it owned by root (uid 0) restricts access to authorized personnel.
What Pavois checks
Pavois asserts that the live directory /var/log/apt has owner uid 0, skipped via only_if when it does not exist. It reads the effective owner from the filesystem (stat), so drift introduced by a manual chown, a log-rotation script or a misbehaving package is caught regardless of what any manifest claims.
only_if { file('/var/log/apt').exist? }
describe file('/var/log/apt') do
its('uid') { should eq 0 }
endHow to verify it is applied
Run stat -c '%U %u' /var/log/apt. Expected output: root 0. To include the log files, run find /var/log/apt -not -user root, it should print nothing.
Inspect & investigate
The directory itself contains the relevant package history: cat /var/log/apt/history.log. Ownership has no separate log; query it with stat /var/log/apt. If /var/log/apt is watched by auditd, ownership changes appear in /var/log/audit/audit.log.
Remediation
No automated harden plan is defined, so apply it manually: chown root:root /var/log/apt and, to cover existing files, chown -R root:root /var/log/apt.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /var/log/apt |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner can read the host's full package history (a reconnaissance gift) or tamper with the install audit trail. Restoring root ownership is safe, APT runs as root and is unaffected. Precaution: keep these logs group-readable only as your policy allows (commonly root:adm, mode 0640); when recursing, avoid widening permissions so non-privileged users cannot read the package inventory.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.