Verify User Who Owns /var/log/*.journal(~) Files
Ensure all persistent journal files under /var/log/journal are owned by root (group systemd-journal).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/*.journal(~) files are the binary system logs managed by systemd-journald. They must be owned by root (with group systemd-journal) so that no unprivileged user can read or rewrite the journal, tampered or readable journals would let an attacker erase their tracks or harvest sensitive log data.
What Pavois checks
Pavois runs find -P /var/log/journal -type f ! -user root (only if persistent journaling is enabled) and expects no output. It checks the real ownership of the live journal files on disk, catching drift introduced after install, not just packaging defaults.
only_if { command('test -d /var/log/journal').exit_status.zero? }
describe command('find -P /var/log/journal -type f ! -user root 2>/dev/null | head -1') do
its('stdout') { should eq '' }
endHow to verify it is applied
Run find -P /var/log/journal -type f ! -user root, it should print nothing. You can also confirm ownership with ls -l /var/log/journal/*/ (expect owner root, group systemd-journal).
Inspect & investigate
These files are the journal itself; read it with journalctl. Check journald health with systemctl show systemd-journald and journalctl --verify. List wrongly-owned files via find -P /var/log/journal -type f ! -user root -printf '%u %p\n'.
Remediation
Pavois's harden plan runs an exec resource named chown-journal that executes find /var/log/journal -exec chown root:systemd-journal {} +, resetting every journal file to owner root and group systemd-journal. A not_if guard skips it when no file already has a wrong group, so it is idempotent. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | find /var/log/journal -exec chown root:systemd-journal {} + 2>/dev/null || true |
|---|---|
| name | chown-journal |
| not_if | test -z "$(find /var/log/journal ! -user root 2>/dev/null | head -1)" |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
What can break: essentially nothing, root:systemd-journal is exactly the ownership systemd-journald expects, so it keeps writing normally. Members of the systemd-journal group retain read access to the logs. Precautions: none significant; the change is idempotent and guarded. On systems with only volatile journaling (/run/log/journal), /var/log/journal is absent and the rule is skipped (only_if).
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.