Verify Permissions on files in the /var/log/apt/.* directory
Ensures the /var/log/apt directory is not writable by group or other (owned root:root, mode 0755).
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/apt directory records which packages were installed, upgraded or removed and when. If group or other can write to it, an attacker could tamper with or forge package-history evidence to hide a malicious install, undermining incident response and integrity assurance. It should be owned by root and writable only by root.
What Pavois checks
Pavois reads the effective inode mode of /var/log/apt and asserts no write bit for group or other. Reading the live directory mode (not a packaging manifest) catches drift from manual chmod, log-rotation hooks, or restores that silently loosened the permissions.
only_if { file('/var/log/apt').exist? }
describe file('/var/log/apt') do
it { should_not be_writable.by('group') }
it { should_not be_writable.by('other') }
endHow to verify it is applied
Run stat -c '%U %G %a' /var/log/apt. Expected: owner/group root with mode 755 (or 0755), no write bit for group or other.
Inspect & investigate
The directory itself holds APT's history: /var/log/apt/history.log and /var/log/apt/term.log show package transactions (apt/dpkg activity). Permission drift on packaged files can be reviewed with dpkg --verify.
Remediation
Run pavois harden apply. Pavois's harden plan manages the /var/log/apt directory resource, setting owner root, group root and mode 0755, which removes any group/other write bit while keeping APT able to write its logs.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | root |
|---|---|
| mode | 0755 |
| owner | root |
| path | /var/log/apt |
| resource | directory |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Group/other-writable APT logs let an attacker falsify package history; the fix (0755 root:root) is the distro default and safe to apply. APT runs as root, so tightening the directory does not break package operations. Precaution: the mode only adjusts the directory, if individual log files inside were also loosened, re-check them after rotation, since logrotate recreates files using its own configured mode.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.