Verify the user owning the /var/log directory
Ensures every file under /var/log is owned by the root or syslog user.
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log tree holds system, authentication and audit logs that must only be reachable by authorized personnel. A log file owned by a user other than root or syslog can be read by that user, exposing error messages, credentials or session data, or rewritten to erase evidence of an attack. Restricting the file owner preserves the confidentiality and integrity of the audit trail.
What Pavois checks
Pavois runs find /var/log -type f ! -user root ! -user syslog and expects empty output. Auditing the live filesystem catches logs created at runtime by daemons, rotated files and operator-dropped files that a static file-list or package check would miss.
describe command('timeout 90 find /var/log -type f ! -user root ! -user syslog ! -user _aide 2>/dev/null') do
its('exit_status') { should_not cmp 124 } # timeout killed the scan: no evidence, not a pass
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Run the scan manually:
find /var/log -type f ! -user root ! -user syslog
Expected output: nothing (empty). Inspect any printed file with ls -l <file>.
Inspect & investigate
List offenders and their owner with find /var/log -type f ! -user root ! -user syslog -printf '%u %p\n'. After fixing, confirm with ls -l /var/log/. Ownership changes are recorded only if an auditd watch on chown is configured.
Remediation
No automated harden plan is defined for this rule, so it must be applied manually. Re-own the offending files with chown root <file> (or syslog where appropriate). On Debian/Ubuntu the related findloop-file-ownerships-var-log rule ships an automated fix; this RHEL/Ubuntu-scoped variant intentionally leaves it to the administrator.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | find /var/log -type f ! -user root ! -user syslog -exec chown root {} + 2>/dev/null; find /var/log -type f ! -group root ! -group adm ! -group syslog ! -group utmp ! -group systemd-journal -exec chgrp root {} + 2>/dev/null; true |
|---|---|
| name | fix-varlog-ownership |
| not_if | test -z "$(find /var/log -type f \( ! -user root ! -user syslog -o ! -group root ! -group adm ! -group syslog ! -group utmp ! -group systemd-journal \) 2>/dev/null | head -1)" |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if left as-is: logs owned by an unprivileged user can leak secrets or be tampered with to hide an intrusion. Before fixing: some services (e.g. a database or web server writing into /var/log/<service>/) deliberately own their logs with a dedicated user; forcing root can break log rotation or stop the daemon writing. Review the listed files and exclude legitimate service-owned subtrees instead of mass-rewriting.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R71 | direct | 2.0 | high |
| CIS | 6.1.4.1, 6.2.4.1, 6.2.6.1, 6.2.3.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
| PCI DSS | 10.3.2 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-232120, UBTU-24-700110 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.