Verify Ownership of Files in /var/log/landscape
Ensures the landscape-client log directory /var/log/landscape is owned by root.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/landscape directory holds logs from the landscape-client (Canonical's systems-management agent), which records administrative and management actions performed on the host. These logs can expose operational details and form an audit trail. If a non-root user owns this directory, they can read it for reconnaissance or alter it to hide management activity. Keeping it owned by root restricts access to authorized personnel.
What Pavois checks
Pavois asserts that the live directory /var/log/landscape has owner root, skipped via only_if when the directory does not exist (landscape-client not installed). It reads the effective owner from the filesystem (stat), so any out-of-band ownership change is caught regardless of deployment manifests.
only_if { file('/var/log/landscape').exist? }
describe file('/var/log/landscape') do
its('owner') { should eq 'root' }
endHow to verify it is applied
Run stat -c '%U' /var/log/landscape. Expected output: root. To include the contents, run find /var/log/landscape -not -user root, it should print nothing.
Inspect & investigate
The directory itself holds the landscape-client logs you may want to inspect. Ownership has no separate log; query it with stat /var/log/landscape. If the path is watched by auditd, ownership changes appear in /var/log/audit/audit.log.
Remediation
Pavois's harden plan uses the file resource to set the owner of /var/log/landscape to root. Apply it with pavois harden apply; Pavois will chown the directory back to root if it has drifted. (Apply -R manually if existing files inside also need correcting.)
Pavois applies this with its own harden engine, the plan below, not a shell script:
| owner | root |
|---|---|
| path | /var/log/landscape |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A non-root owner can read management logs (reconnaissance) or tamper with the activity record. Restoring root ownership is safe, landscape-client runs with elevated privileges and is unaffected. Precaution: keep permissions restrictive (root-only or root:adm per policy); the harden plan only sets the owner, so review group/mode separately if your baseline requires it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.2.2.1, 6.1.4.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.