mediumloggingverified ✓rollback-safe

Ensure system journal directories are owned by root

journal-dirs-owner · UBUNTU ≥ 22 · 1 impl

Description

All directories under /run/log/journal and /var/log/journal must be owned by root so that only the root account can manage the systemd journal store.

Rationale

Journal directories owned by a non-root account could let that account remove or replace journal files, destroying or falsifying the operational and security record the journal is meant to preserve.

Check → Remediate

Checkcommand

find /run/log/journal /var/log/journal ! -user root -type d 2>/dev/null | head -1

Remediatefile_permissions

find_paths:: /run/log/journal, /var/log/journal
find_type:: d
find_args:: ! -user root
owner:: root

Framework references

STIG

V-270763 / UBTU-24-700080V-260501 / UBTU-22-232080

NIST 800-53

SI-11AC-6

Live verification

ubuntu22:checkubuntu24:check

#journald#permissions#logging