Skip to content
Log In

Verify group-owner of system journal directories

An XCCDF Rule

Description

Verify the /run/log/journal and /var/log/journal directories are group-owned by "systemd-journal" by using the following command: 
$ sudo find /run/log/journal /var/log/journal  -type d -exec stat -c "%n %G" {} \;
If any output returned is not owned by "systemd-journal", this is a finding.

Rationale

Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can identify the operating system or platform. Additionally, personally identifiable information (PII) and operational information must not be revealed through error messages to unauthorized personnel or their designated representatives.

ID
xccdf_org.ssgproject.content_rule_dir_groupowner_system_journal
Severity
Medium
References
Updated

Remediation Templates

An Ansible Snippet

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-UBTU-22-232085
  - configure_strategy

A Shell Script

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}
' 'kernel' 2>/dev/null | grep -q installed; then
TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"

if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then