Verify Groupownership of Files in /var/log/gdm
Ensures every file under /var/log/gdm is group-owned by gdm or root (when the directory exists).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/gdm directory holds logs of the GNOME Display Manager, which can include session, authentication and X server diagnostics. If these files are group-owned by an unexpected group, members of that group could read sensitive display-manager details or tamper with the logs. Restricting group ownership to gdm or root keeps this information accessible only to authorized personnel.
What Pavois checks
Guarded by only_if test -d /var/log/gdm so it is skipped on headless servers without GDM. Pavois then runs find -P /var/log/gdm -type f ! -group gdm ! -group root and expects empty output. Reading the actual group on each inode catches runtime-created logs that a packaging or config check would not see.
only_if { command('test -d /var/log/gdm').exit_status.zero? }
describe command('timeout 60 find -P /var/log/gdm -type f ! -group gdm ! -group root -print -quit 2>/dev/null') do
its('exit_status') { should_not cmp 124 } # timeout killed the scan: no evidence, not a pass
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Run sudo find /var/log/gdm -type f ! -group gdm ! -group root 2>/dev/null. Expected output: empty. Inspect any returned file with ls -l <path> to see its wrong group.
Inspect & investigate
List offending files with their group via find /var/log/gdm -type f -printf '%g %p\n'. There is no daemon log for ownership; verify directly with stat -c '%G %n' /var/log/gdm/*.
Remediation
No automated harden plan is provided. Fix it manually with chgrp gdm <file> for each offending file, e.g. find /var/log/gdm -type f ! -group gdm ! -group root -exec chgrp gdm {} +.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # Set root ownership recursively under the gdm log dir (only if it exists): [ -d /var/log/gdm ] && find /var/log/gdm -print0 | xargs -0 -r chown root: || echo 'no /var/log/gdm' |
|---|---|
| reason | recursive ownership fix under /var/log/gdm, verify the service is present and review |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Changing the group of GDM logs is low-risk and has no effect on headless servers (the check is skipped). On graphical hosts, set the group GDM expects so the display manager retains the ability to write its logs; using the wrong group could prevent GDM from logging diagnostics. No session or login disruption results from a simple chgrp.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.