mediumloggingverified ✓rollback-safe
Ensure system journal directories are group-owned by systemd-journal
journal-dirs-group · UBUNTU ≥ 22 · 1 impl
Description
All directories under /run/log/journal and /var/log/journal must be group-owned by systemd-journal, the group systemd grants controlled journal access to.
Rationale
Journal directories group-owned by an unexpected group could let members of that group remove or replace journal files, destroying or falsifying the operational and security record the journal is meant to preserve.
Check → Remediate
Checkcommand
find /run/log/journal /var/log/journal ! -group systemd-journal -type d 2>/dev/null | head -1
Remediatefile_permissions
- find_paths:
- /run/log/journal, /var/log/journal
- find_type:
- d
- find_args:
- ! -group systemd-journal
- group:
- systemd-journal
Framework references
STIG
V-270761 / UBTU-24-700060V-260502 / UBTU-22-232085
NIST 800-53
SI-11AC-6
Live verification
ubuntu22:checkubuntu24:check
#journald#permissions#logging