# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-UBU-AUDIT-004
title: Restrict access to log files
finding:
  title: Log files are readable or writable by too many users
  description: Logs hold user names, addresses, commands and sometimes secrets; files readable by everyone leak them, and writable files can be falsified.
status: active
profiles: [core]
risk:
  severity: medium
assessment: automated
tags: [logging, permissions, journald]

description: |
  Every regular file under `/var/log/`, including the journal files in `/var/log/journal/`, must
  have no permission for other users, no write permission for its group and no execute bit
  (mode `0640` or stricter).

  Two exceptions:

  - the session records `wtmp`, `btmp` and `lastlog` (and their rotated copies) must stay writable
    by the `utmp` group, and `wtmp` and `lastlog` readable by everyone for `last` and `lastlog` to
    work: for them only execute bits and writes by other users are forbidden (mode `0664` or
    stricter);
  - the package manager logs in `/var/log/apt/`, which apt recreates readable by everyone at each
    run, may be `0644`;
  - the files matching `tolerated_0644` (by default `dpkg.log*` and `alternatives.log*`, which
    logrotate recreates with `create 0644`, and the daily `sysstat` data files `sa??` and `sar??`,
    which `sadc` creates readable by everyone) may be `0644` too. They must never be writable by
    group or others.

  journald creates its files with mode `0640` (set in `/usr/lib/tmpfiles.d/systemd.conf`), and
  rsyslog with `$FileCreateMode` (CB-UBU-AUDIT-005).
rationale: |
  Logs record failed logins (sometimes with a password typed in the user name field), source
  addresses, commands and application data. Readable logs help an attacker map the system;
  writable logs let them erase or forge their traces.
impact: |
  Users who are not in the `adm` group can no longer read files such as `/var/log/cloud-init.log`.
  Grant access with group membership (`adm`) instead of wider modes.
notes: |
  On a fresh Ubuntu cloud image, `dpkg.log`, `alternatives.log`, the files of `/var/log/apt/` and
  `unattended-upgrades/unattended-upgrades-shutdown.log` are `0644`, and on Ubuntu 20.04 also
  `ubuntu-advantage.log` and the `dmesg` files, and from 24.04 the `sysstat` files of
  `/var/log/sysstat/`. A file recreated by its program or by logrotate with a
  `create 0644` directive goes back to the wider mode until the fix runs again: list such files
  in `tolerated_0644`, or change the `create` mode in `/etc/logrotate.d/`.

setting:
  location: /var/log/
  default_value: Several files 0644
  recommended_value: "0640 or stricter; 0664 for wtmp, btmp and lastlog; 0644 in /var/log/apt and for {{ tolerated_0644 }}"

parameters:
  - name: tolerated_0644
    type: list
    description: File name patterns under /var/log allowed to be 0644 (never group or world writable).
    default: ["dpkg.log*", "alternatives.log*", "sa[0-9][0-9]", "sar[0-9][0-9]"]

audit:
  manual: |
    Run, as root:
    ```
    find /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' -perm /0137 -ls
    find /var/log -type f \( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \) -perm /0113 -ls
    find /var/log/apt -type f -perm /0133 -ls
    ```
    The commands must print nothing, except files matching {{ tolerated_0644 }} reported by the
    first command with mode `0644` (they must not be writable by group or others).
  checks:
    - id: var-log
      engine: shell
      description: Files under /var/log with more access than allowed.
      spec:
        script: |
          [ -d /var/log ] || exit 2
          set -f
          ex= tol=
          for p in $CB_TOLERATED_0644; do ex="$ex ! -name $p"; tol="$tol -o -name $p"; done
          bad=$( { find /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' $ex -perm /0137
            find /var/log -type f \( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \) -perm /0113
            find /var/log/apt -type f -perm /0133
            [ -z "$tol" ] || find /var/log -type f \( ${tol# -o } \) -perm /0133; } 2>/dev/null)
          set +f
          if [ -n "$bad" ]; then
            printf '%s\n' "$bad" | while IFS= read -r f; do stat -c '%n %a' "$f"; done
            exit 1
          fi
          echo "no log file under /var/log is more permissive than allowed"

remediation:
  manual: |
    Run, as root:
    ```
    find /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +
    find /var/log -type f \( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \) -perm /0113 -exec chmod u-x,g-x,o-wx {} +
    find /var/log/apt -type f -perm /0133 -exec chmod u-x,g-wx,o-wx {} +
    ```
    For files rotated by logrotate, also change the `create` mode in the matching
    `/etc/logrotate.d/` file.
  effects:
    restart: none
    disruption: low
    lockout_risk: false
  rollback: |
    Run `chmod 644` on the files that need to be readable by everyone again.
  scripts:
    - id: chmod
      engine: shell
      content: |
        set -f
        ex= tol=
        for p in $CB_TOLERATED_0644; do ex="$ex ! -name $p"; tol="$tol -o -name $p"; done
        find /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' $ex -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +
        find /var/log -type f \( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \) -perm /0113 -exec chmod u-x,g-x,o-wx {} +
        find /var/log/apt -type f -perm /0133 -exec chmod u-x,g-wx,o-wx {} +
        [ -z "$tol" ] || find /var/log -type f \( ${tol# -o } \) -perm /0133 -exec chmod u-x,g-wx,o-wx {} +
        set +f

references:
  - title: tmpfiles.d(5), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man5/tmpfiles.d.5.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: logrotate(8), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man8/logrotate.8.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R71)
    url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-19
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R71
    relation: partial
    note: R71 asks for protected logs; this control covers local file permissions.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AU-9
    relation: related
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "6.2.1.2"
    relation: equivalent
  - framework: cis-ubuntu-2004
    framework_version: "3.0.0"
    id: "6.2.4.1"
    relation: partial
    note: Ours checks modes only, not owners; it does not allow 0644 for cloud-init logs.
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "6.1.1.1.2"
    relation: equivalent
  - framework: cis-ubuntu-2204
    framework_version: "3.0.0"
    id: "6.1.3.1"
    relation: partial
    note: Ours checks modes only, not owners; it does not allow 0644 for cloud-init logs.
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "6.1.1.1.4"
    relation: equivalent
  - framework: cis-ubuntu-2404
    framework_version: "2.0.0"
    id: "6.1.3.1"
    relation: partial
    note: Ours checks modes only, not owners; it does not allow 0644 for cloud-init logs.
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "6.1.1.1.4"
    relation: equivalent
  - framework: cis-ubuntu-2604
    framework_version: "1.0.0"
    id: "6.1.3.1"
    relation: partial
    note: Ours checks modes only, not owners; it does not allow 0644 for cloud-init logs.
threats:
  - framework: mitre-attack
    id: T1070.002
  - framework: cwe
    id: CWE-532
  - framework: cwe
    id: CWE-732

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["20.04"]
    environment: Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic
    notes: "Fails on stock image (ubuntu-advantage.log, dmesg*, unattended-upgrades-shutdown.log 0644); fix chmods, passes after reboot."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["22.04"]
    environment: Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic
    notes: "Fails on stock image (unattended-upgrades-shutdown.log 0644); fix chmods, passes after reboot."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["24.04"]
    environment: Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic
    notes: "Fails on stock image (sysstat sa file, unattended-upgrades-shutdown.log 0644); fix chmods, passes after reboot; sa?? now tolerated."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["26.04"]
    environment: Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic
    notes: "Fails on stock image (sysstat sa file, unattended-upgrades-shutdown.log 0644); fix chmods, passes after reboot; sa?? now tolerated."
introduced_in: 0.1.0
created: 2026-10-19
updated: 2026-10-19