mediumfilesystemverified ✓rollback-safe
Restrict the mode of the /var/log directory
var-log-dir-mode · UBUNTU ≥ 22 · 1 impl
Description
The /var/log directory must have mode 0755 or less permissive so that unprivileged users cannot create, rename, or remove files in the system log directory.
Rationale
An overly permissive /var/log directory mode would allow unauthorized users to tamper with log files, undermining the integrity of the audit trail.
Check → Remediate
Checkfile_permission
- path:
- /var/log
- mode:
- 0755
Remediatefile_permissions
- path:
- /var/log
- mode:
- 0755
Framework references
STIG
V-270767 / UBTU-24-700120V-260488 / UBTU-22-232025
NIST 800-53
SI-11
Live verification
ubuntu22:checkubuntu24:checkubuntu26:check
#file-permissions#logging#security