Verify Permissions on /var/log/localmessages(.*) Files
Ensure /var/log/localmessages carries no execute, setuid, setgid or sticky bit and is not group/other-writable, so local boot and service messages cannot be altered.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/log/localmessages collects messages from certain boot scripts and local0:local7 syslog facilities (DHCP client, custom services, etc.). If it is group- or other-writable an attacker can inject misleading entries or erase evidence of their activity, and execute or setuid/setgid bits on a log file indicate tampering. Restricting access keeps these local logs trustworthy.
What Pavois checks
Pavois reads the live inode of /var/log/localmessages and asserts no execute, setuid, setgid or sticky bit and no group/other write. Reading the real filesystem object catches permission drift that a config-file or package check would miss, the effective mode is what governs access at runtime.
only_if { file('/var/log/localmessages').exist? }
describe file('/var/log/localmessages') do
it { should_not be_executable.by('owner') }
it { should_not be_setuid }
it { should_not be_executable.by('group') }
it { should_not be_writable.by('group') }
it { should_not be_setgid }
it { should_not be_executable.by('other') }
it { should_not be_writable.by('other') }
it { should_not be_sticky }
endHow to verify it is applied
Run stat -c '%A %U:%G' /var/log/localmessages. Expect a mode like -rw-r----- root:adm (0640 or stricter) with no x, s, S, t, T, and no group/other write bit.
Inspect & investigate
This file is a log; inspect its content with tail -n 50 /var/log/localmessages. To detect permission tampering, add auditctl -w /var/log/localmessages -p wa and check /var/log/audit/audit.log. Current state: ls -l /var/log/localmessages.
Remediation
No automated harden plan ships for this rule, so it must be applied manually: chown root:adm /var/log/localmessages and chmod u-x,g-wx,o-rwx,u-s,g-s,-t /var/log/localmessages (commonly chmod 0640).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| mode | 0644 |
|---|---|
| path | /var/log/localmessages |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
A writable local log can be poisoned or truncated, undermining incident analysis. Precautions: logrotate recreates this file from /etc/logrotate.d and rsyslog's $FileCreateMode, so set the matching create 0640 root adm directive too, otherwise the next rotation will reintroduce the loose mode. Keep root:adm ownership so the adm group can still read logs; do not make it 0600 if log-reading tooling runs as the adm group.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.