Verify Ownership of Files in /var/log/gdm3
Ensure every file under /var/log/gdm3 is owned by root (UID 0).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The /var/log/gdm3 directory holds logs from the GNOME Display Manager (GDM), which can contain session, authentication and X server details. If these files are owned by a non-root user, that user could tamper with or read sensitive log data; restricting ownership to root keeps the audit trail trustworthy.
What Pavois checks
Pavois runs find -P /var/log/gdm3 -type f ! -user 0 (only if the directory exists) and expects no output. It inspects the real inodes' effective ownership rather than relying on packaging defaults, so any log file created or re-owned at runtime by GDM is caught.
only_if { command('test -d /var/log/gdm3').exit_status.zero? }
describe command('timeout 60 find -P /var/log/gdm3 -type f ! -user 0 -print -quit 2>/dev/null') do
its('exit_status') { should_not cmp 124 } # timeout killed the scan: no evidence, not a pass
its('stdout.strip') { should eq '' }
endHow to verify it is applied
Run find -P /var/log/gdm3 -type f ! -user 0, it should print nothing. Any printed line is a non-root-owned log file to fix.
Inspect & investigate
List offending files with find -P /var/log/gdm3 -type f ! -user 0 -printf '%u %p\n'. The GDM logs themselves live here (e.g. :0.log); display-manager service events can be reviewed with journalctl -u gdm3.
Remediation
There is no automated harden plan for this rule. Apply it manually after review: find -P /var/log/gdm3 -type f ! -user 0 -exec chown root {} +. (This rule is only relevant on systems with a graphical session / GDM installed.)
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # Set root ownership recursively under the gdm log dir (only if it exists): [ -d /var/log/gdm ] && find /var/log/gdm -print0 | xargs -0 -r chown root: || echo 'no /var/log/gdm' |
|---|---|
| reason | recursive ownership fix under /var/log/gdm, verify the service is present and review |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
What can break: essentially nothing, GDM continues to write its logs regardless of owner. Precautions: review files before re-owning; a non-root owner here may indicate GDM was run abnormally or a misconfigured log rotation. On headless servers without GDM the directory is absent and the rule is automatically skipped (only_if).
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.