Verify Group Who Owns /var/log/*.journal(~) File
Ensures every file under /var/log/journal is group-owned by systemd-journal or root (when the directory exists).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/*.journal files are the persistent system logs managed by systemd-journald. They record authentication, kernel, service and audit-relevant events. The systemd-journal group is the controlled boundary for who may read the journal; if these files are group-owned by an unexpected group, members could read sensitive event data or, if also writable, corrupt the journal and destroy forensic evidence. Restricting group ownership to systemd-journal (or root) preserves both confidentiality and integrity of the journal.
What Pavois checks
Guarded by only_if test -d /var/log/journal so it is skipped when persistent journaling is off (volatile-only). Pavois then runs find -P /var/log/journal -type f ! -group systemd-journal ! -group root and expects empty output. Reading the real group on each .journal inode catches files rotated/created at runtime by journald, a static config audit of journald.conf cannot.
only_if { command('test -d /var/log/journal').exit_status.zero? }
describe command('find -P /var/log/journal -type f ! -group systemd-journal ! -group root 2>/dev/null | head -1') do
its('stdout') { should eq '' }
endHow to verify it is applied
Run sudo find /var/log/journal -type f ! -group systemd-journal ! -group root 2>/dev/null. Expected output: empty. You can also check with stat -c '%U:%G %n' /var/log/journal/*/*.journal (expected owner/group root:systemd-journal).
Inspect & investigate
Inspect journald itself with journalctl -u systemd-journald and systemctl show systemd-journald. List file groups with find /var/log/journal -type f -printf '%g %p\n'; run journalctl --verify to confirm the journal files are not corrupted after any ownership change.
Remediation
Pavois's harden plan runs an exec resource named chown-journal that applies chown root:systemd-journal to everything under /var/log/journal, restoring the expected owner and group. A not_if guard skips the action when no file has the wrong group, so it is idempotent. Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | find /var/log/journal -exec chown root:systemd-journal {} + 2>/dev/null || true |
|---|---|
| name | chown-journal |
| not_if | test -z "$(find /var/log/journal ! -group systemd-journal 2>/dev/null)" |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Resetting the journal files to root:systemd-journal is the documented systemd default and is low-risk: journald keeps writing and the systemd-journal group keeps read access. The harden command also touches directory entries; this does not stop logging. As a precaution, run journalctl --verify afterward to confirm integrity, and avoid manually chmod-ing journal files to broader permissions, which would defeat the access control this rule enforces.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.