mediumloggingverified ✓rollback-safe
Ensure system journal files are group-owned by systemd-journal
journal-files-group · UBUNTU ≥ 22 · 1 impl
Description
All files under /run/log/journal and /var/log/journal must be group-owned by systemd-journal, the group systemd grants controlled journal access to.
Rationale
Journal files group-owned by an unexpected group could be edited or deleted by members of that group, destroying or falsifying the operational and security record the journal is meant to preserve.
Check → Remediate
Checkcommand
find /run/log/journal /var/log/journal ! -group systemd-journal -type f 2>/dev/null | head -1
Remediatefile_permissions
- find_paths:
- /run/log/journal, /var/log/journal
- find_type:
- f
- find_args:
- ! -group systemd-journal
- group:
- systemd-journal
Framework references
STIG
V-270762 / UBTU-24-700070V-260504 / UBTU-22-232095
NIST 800-53
SI-11AC-6
Live verification
ubuntu22:checkubuntu24:check
#journald#permissions#logging