Verify Permissions of Files in /var/log/gdm3
Ensures the /var/log/gdm3 directory is not readable/writable/executable by other and not executable by group, with no setuid/setgid/sticky bits.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/gdm3 directory holds logs of the GNOME Display Manager (the graphical login daemon), including session start details and X/Wayland diagnostics that can expose usernames, display configuration and local environment data. If readable or writable by other, an attacker can harvest this information or tamper with login evidence. Access should be restricted to root and the GDM service account.
What Pavois checks
Pavois reads the effective inode mode of /var/log/gdm3 and asserts no access for other, no group execute, and no special bits. Reading the live mode catches drift introduced when GDM (or a desktop install/upgrade) recreates the directory, which a static packaging manifest would not reflect.
only_if { file('/var/log/gdm3').exist? }
describe file('/var/log/gdm3') do
it { should_not be_setuid }
it { should_not be_setgid }
it { should_not be_writable.by('other') }
it { should_not be_readable.by('other') }
endHow to verify it is applied
Run stat -c '%U %G %a' /var/log/gdm3. Expected: owner root, mode 750 or stricter, no read/write/execute for other.
Inspect & investigate
GDM session logs live under /var/log/gdm3/; the display manager's service state is shown by systemctl status gdm3 and journalctl -u gdm3. Re-check the directory mode after a desktop package upgrade.
Remediation
No automated remediation ships for this rule. Tighten manually: chown root:gdm /var/log/gdm3 && chmod 750 /var/log/gdm3 and restrict the log files inside with chmod 640 /var/log/gdm3/*.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| mode | 0750 |
|---|---|
| path | /var/log/gdm3 |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Over-exposed GDM logs leak session and environment details. Restricting to root/gdm is safe on graphical systems. This control only applies where GDM is installed (the only_if guards it), so headless servers are unaffected. Precaution: keep the gdm group able to traverse/read where it legitimately needs to, over-restricting /var/log/gdm3 could prevent the display manager from writing its logs.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.