{
  "id": "CB-UBU-AUDIT-004",
  "standard": "ubuntu",
  "version": "0.1.2",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-AUDIT-004",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-AUDIT-004.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-AUDIT-004.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-AUDIT-004",
    "title": "Restrict access to log files",
    "finding": {
      "title": "Log files are readable or writable by too many users",
      "description": "Logs hold user names, addresses, commands and sometimes secrets; files readable by everyone leak them, and writable files can be falsified."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "logging",
      "permissions",
      "journald"
    ],
    "description": "Every regular file under `/var/log/`, including the journal files in `/var/log/journal/`, must\nhave no permission for other users, no write permission for its group and no execute bit\n(mode `0640` or stricter).\n\nTwo exceptions:\n\n- the session records `wtmp`, `btmp` and `lastlog` (and their rotated copies) must stay writable\n  by the `utmp` group, and `wtmp` and `lastlog` readable by everyone for `last` and `lastlog` to\n  work: for them only execute bits and writes by other users are forbidden (mode `0664` or\n  stricter);\n- the package manager logs in `/var/log/apt/`, which apt recreates readable by everyone at each\n  run, may be `0644`;\n- the files matching `tolerated_0644` (by default `dpkg.log*` and `alternatives.log*`, which\n  logrotate recreates with `create 0644`, and the daily `sysstat` data files `sa??` and `sar??`,\n  which `sadc` creates readable by everyone) may be `0644` too. They must never be writable by\n  group or others.\n\njournald creates its files with mode `0640` (set in `/usr/lib/tmpfiles.d/systemd.conf`), and\nrsyslog with `$FileCreateMode` (CB-UBU-AUDIT-005).\n",
    "rationale": "Logs record failed logins (sometimes with a password typed in the user name field), source\naddresses, commands and application data. Readable logs help an attacker map the system;\nwritable logs let them erase or forge their traces.\n",
    "impact": "Users who are not in the `adm` group can no longer read files such as `/var/log/cloud-init.log`.\nGrant access with group membership (`adm`) instead of wider modes.\n",
    "notes": "On a fresh Ubuntu cloud image, `dpkg.log`, `alternatives.log`, the files of `/var/log/apt/` and\n`unattended-upgrades/unattended-upgrades-shutdown.log` are `0644`, and on Ubuntu 20.04 also\n`ubuntu-advantage.log` and the `dmesg` files, and from 24.04 the `sysstat` files of\n`/var/log/sysstat/`. A file recreated by its program or by logrotate with a\n`create 0644` directive goes back to the wider mode until the fix runs again: list such files\nin `tolerated_0644`, or change the `create` mode in `/etc/logrotate.d/`.\n",
    "setting": {
      "location": "/var/log/",
      "default_value": "Several files 0644",
      "recommended_value": "0640 or stricter; 0664 for wtmp, btmp and lastlog; 0644 in /var/log/apt and for {{ tolerated_0644 }}"
    },
    "parameters": [
      {
        "name": "tolerated_0644",
        "type": "list",
        "description": "File name patterns under /var/log allowed to be 0644 (never group or world writable).",
        "default": [
          "dpkg.log*",
          "alternatives.log*",
          "sa[0-9][0-9]",
          "sar[0-9][0-9]",
          "Xorg.*.log*"
        ]
      }
    ],
    "audit": {
      "manual": "Run, as root:\n```\nfind /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' -perm /0137 -ls\nfind /var/log -type f \\( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \\) -perm /0113 -ls\nfind /var/log/apt -type f -perm /0133 -ls\n```\nThe commands must print nothing, except files matching {{ tolerated_0644 }} reported by the\nfirst command with mode `0644` (they must not be writable by group or others).\n",
      "checks": [
        {
          "id": "var-log",
          "engine": "shell",
          "description": "Files under /var/log with more access than allowed.",
          "spec": {
            "script": "[ -d /var/log ] || exit 2\nset -f\nex= tol=\nfor p in $CB_TOLERATED_0644; do ex=\"$ex ! -name $p\"; tol=\"$tol -o -name $p\"; done\nbad=$( { find /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' $ex -perm /0137\n  find /var/log -type f \\( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \\) -perm /0113\n  find /var/log/apt -type f -perm /0133\n  [ -z \"$tol\" ] || find /var/log -type f \\( ${tol# -o } \\) -perm /0133; } 2>/dev/null)\nset +f\nif [ -n \"$bad\" ]; then\n  printf '%s\\n' \"$bad\" | while IFS= read -r f; do stat -c '%n %a' \"$f\"; done\n  exit 1\nfi\necho \"no log file under /var/log is more permissive than allowed\"\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Run, as root:\n```\nfind /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +\nfind /var/log -type f \\( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \\) -perm /0113 -exec chmod u-x,g-x,o-wx {} +\nfind /var/log/apt -type f -perm /0133 -exec chmod u-x,g-wx,o-wx {} +\n```\nFor files rotated by logrotate, also change the `create` mode in the matching\n`/etc/logrotate.d/` file.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Run `chmod 644` on the files that need to be readable by everyone again.\n",
      "scripts": [
        {
          "id": "chmod",
          "engine": "shell",
          "content": "set -f\nex= tol=\nfor p in $CB_TOLERATED_0644; do ex=\"$ex ! -name $p\"; tol=\"$tol -o -name $p\"; done\nfind /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' $ex -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +\nfind /var/log -type f \\( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \\) -perm /0113 -exec chmod u-x,g-x,o-wx {} +\nfind /var/log/apt -type f -perm /0133 -exec chmod u-x,g-wx,o-wx {} +\n[ -z \"$tol\" ] || find /var/log -type f \\( ${tol# -o } \\) -perm /0133 -exec chmod u-x,g-wx,o-wx {} +\nset +f\n"
        }
      ]
    },
    "references": [
      {
        "title": "tmpfiles.d(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/tmpfiles.d.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "logrotate(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/logrotate.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R71)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R71",
        "relation": "partial",
        "note": "R71 asks for protected logs; this control covers local file permissions."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-9",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1070.002"
      },
      {
        "framework": "cwe",
        "id": "CWE-532"
      },
      {
        "framework": "cwe",
        "id": "CWE-732"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Fails on stock image (ubuntu-advantage.log, dmesg*, unattended-upgrades-shutdown.log 0644); fix chmods, passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Fails on stock image (unattended-upgrades-shutdown.log 0644); fix chmods, passes after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Fails on stock image (sysstat sa file, unattended-upgrades-shutdown.log 0644); fix chmods, passes after reboot; sa?? now tolerated."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Fails on stock image (sysstat sa file, unattended-upgrades-shutdown.log 0644); fix chmods, passes after reboot; sa?? now tolerated."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}