Verify Permissions on /var/log/messages File
Ensure /var/log/messages is readable/writable only by root, no execute, setuid, setgid or sticky bit and no group/other read or write, protecting the main RHEL system log.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
Why this rule matters
/var/log/messages is the primary catch-all system log on RHEL-family systems and frequently contains sensitive operational detail (hostnames, service errors, occasionally credentials echoed by misbehaving daemons). If it is group/other-readable, unprivileged users gain a reconnaissance feed; if writable, they can forge or delete entries to hide an attack. Restricting it to root preserves both confidentiality and the integrity of the audit trail.
What Pavois checks
Pavois reads the live inode of /var/log/messages and asserts that group and other have neither read, write nor execute, and that no setuid/setgid/sticky bit is set. Inspecting the real filesystem object (not /etc/rsyslog.conf) catches a file that drifted to 0644 after a manual edit or a botched logrotate, the effective mode is what actually exposes the data.
only_if { file('/var/log/messages').exist? }
describe file('/var/log/messages') do
it { should_not be_executable.by('owner') }
it { should_not be_setuid }
it { should_not be_executable.by('group') }
it { should_not be_writable.by('group') }
it { should_not be_readable.by('group') }
it { should_not be_setgid }
it { should_not be_executable.by('other') }
it { should_not be_writable.by('other') }
it { should_not be_readable.by('other') }
it { should_not be_sticky }
endHow to verify it is applied
Run stat -c '%A %U:%G' /var/log/messages. Expect -rw------- (0600) owned by root:root, no r/w/x for group or other, and no s/t bits.
Inspect & investigate
This file is the log; inspect with tail -n 50 /var/log/messages or journalctl (RHEL also keeps the journal). To detect permission tampering, add auditctl -w /var/log/messages -p wa and review /var/log/audit/audit.log. Current state: ls -l /var/log/messages.
Remediation
No automated harden plan ships for this rule, so it must be applied manually: chown root:root /var/log/messages and chmod 0600 /var/log/messages.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| mode | 0600 |
|---|---|
| path | /var/log/messages |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Loose permissions leak system internals to any local user and let logs be rewritten. Precautions: ensure rsyslog's $FileCreateMode 0600 and the matching logrotate create 0600 root root directive are set, or the next rotation reintroduces a permissive mode. Tightening to 0600 can break log-collection agents that read /var/log/messages as a non-root user (e.g. monitoring shippers), run such agents as root or grant them via an ACL rather than widening the file mode.