From f914570bc62f3c0ee2c7bc93d7d0d3782fdb0fa4 Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Tue, 25 Aug 2026 14:27:49 +0100 Subject: [PATCH 1/8] Change tmpfiles.d conf path per stig noble v1r6 Create the macro to write the journal drop-in configurations in /etc/tmpfiles.d Signed-off-by: Alan Moore --- .../bash/ubuntu.sh | 18 +-------- .../dir_owner_system_journal/bash/ubuntu.sh | 18 +-------- .../dir_owner_system_journal/rule.yml | 11 +++--- .../bash/ubuntu.sh | 18 +-------- .../dir_permissions_system_journal/rule.yml | 11 ++++-- .../bash/ubuntu.sh | 18 +-------- .../file_groupowner_system_journal/rule.yml | 10 +++-- .../file_owner_system_journal/bash/ubuntu.sh | 18 +-------- .../file_owner_system_journal/rule.yml | 10 +++-- .../bash/ubuntu.sh | 18 +-------- .../file_permissions_system_journal/rule.yml | 14 ++++--- shared/macros/10-bash.jinja | 39 +++++++++++++++++++ 12 files changed, 80 insertions(+), 123 deletions(-) diff --git a/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/bash/ubuntu.sh b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/bash/ubuntu.sh index 1e53e273926f..aed3541ccb6f 100644 --- a/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/bash/ubuntu.sh +++ b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/bash/ubuntu.sh @@ -1,19 +1,3 @@ # platform = multi_platform_ubuntu -TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf" - -if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -systemd-tmpfiles --create +{{{ bash_set_journal_tmpfiles(2750) }}} diff --git a/linux_os/guide/system/logging/journald/dir_owner_system_journal/bash/ubuntu.sh b/linux_os/guide/system/logging/journald/dir_owner_system_journal/bash/ubuntu.sh index 1e53e273926f..aed3541ccb6f 100644 --- a/linux_os/guide/system/logging/journald/dir_owner_system_journal/bash/ubuntu.sh +++ b/linux_os/guide/system/logging/journald/dir_owner_system_journal/bash/ubuntu.sh @@ -1,19 +1,3 @@ # platform = multi_platform_ubuntu -TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf" - -if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -systemd-tmpfiles --create +{{{ bash_set_journal_tmpfiles(2750) }}} diff --git a/linux_os/guide/system/logging/journald/dir_owner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/dir_owner_system_journal/rule.yml index 165d1ff7ac52..3eff30d1ee59 100644 --- a/linux_os/guide/system/logging/journald/dir_owner_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/dir_owner_system_journal/rule.yml @@ -21,13 +21,14 @@ severity: medium fixtext: | Configure the system to set the appropriate ownership to the directories - used by the systemd journal. Add or modify the following lines in the - "/usr/lib/tmpfiles.d/systemd.conf" file: + used by the systemd journal. + Create the drop-in file "/etc/tmpfiles.d/zzz-systemd-stig.conf" with the + following content: 
-    z /run/log/journal 2640 root systemd-journal - -
-    z /var/log/journal 2640 root systemd-journal - -
+    z /run/log/journal 0640 root systemd-journal - -
+    z /var/log/journal 0640 root systemd-journal - -
- Restart the system for the changes to take effect. + Note: Restart the system for these settings to take effect. template: name: file_owner diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/bash/ubuntu.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/bash/ubuntu.sh index 1e53e273926f..aed3541ccb6f 100644 --- a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/bash/ubuntu.sh +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/bash/ubuntu.sh @@ -1,19 +1,3 @@ # platform = multi_platform_ubuntu -TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf" - -if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -systemd-tmpfiles --create +{{{ bash_set_journal_tmpfiles(2750) }}} diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/rule.yml b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/rule.yml index c09b608e3749..1c8106591eed 100644 --- a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/rule.yml @@ -19,15 +19,20 @@ severity: medium fixtext: | Configure the system to set the appropriate permissions to the files and directories - used by the systemd journal: - Add or modify the following lines in the "/etc/tmpfiles.d/systemd.conf" file: + used by the systemd journal. + Create a drop-in file, if it does not already exist with the following command: + 
+    $ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf
+
+ Add or modify the following lines in the "/usr/lib/tmpfiles.d/zzz-systemd-stig.conf" file: 
     z /run/log/journal 2750 root systemd-journal - -
     Z /run/log/journal/%m ~2750 root systemd-journal - -
     z /var/log/journal 2750 root systemd-journal - -
     z /var/log/journal/%m 2750 root systemd-journal - -
+    z /var/log/journal/%m/system.journal 2750 root systemd-journal - -
- Restart the system for the changes to take effect. + Note: Restart the system for these settings to take effect. template: name: file_permissions diff --git a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/bash/ubuntu.sh b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/bash/ubuntu.sh index 1e53e273926f..aed3541ccb6f 100644 --- a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/bash/ubuntu.sh +++ b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/bash/ubuntu.sh @@ -1,19 +1,3 @@ # platform = multi_platform_ubuntu -TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf" - -if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -systemd-tmpfiles --create +{{{ bash_set_journal_tmpfiles(2750) }}} diff --git a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml index d8bc652448b0..530a2e760b3a 100644 --- a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml @@ -1,6 +1,5 @@ documentation_complete: true - title: 'Verify Group Who Owns the system journal' description: |- @@ -35,12 +34,15 @@ severity: medium fixtext: | {{%- if 'ubuntu' in product %}} Configure the system to set the appropriate group-ownership to the files - used by the systemd journal: - Add or modify the following lines in the "/etc/tmpfiles.d/systemd.conf" file: + used by the systemd journal. + Create the drop-in file "/etc/tmpfiles.d/zzz-systemd-stig.conf" with the + following content: 
+    Z /run/log/journal/%m ~0640 root systemd-journal - -
+    z /var/log/journal/%m 0640 root systemd-journal - -
     z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
- Restart the system for the changes to take effect. + Note: Restart the system for these settings to take effect. {{%- endif %}} references: diff --git a/linux_os/guide/system/logging/journald/file_owner_system_journal/bash/ubuntu.sh b/linux_os/guide/system/logging/journald/file_owner_system_journal/bash/ubuntu.sh index 1e53e273926f..aed3541ccb6f 100644 --- a/linux_os/guide/system/logging/journald/file_owner_system_journal/bash/ubuntu.sh +++ b/linux_os/guide/system/logging/journald/file_owner_system_journal/bash/ubuntu.sh @@ -1,19 +1,3 @@ # platform = multi_platform_ubuntu -TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf" - -if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -systemd-tmpfiles --create +{{{ bash_set_journal_tmpfiles(2750) }}} diff --git a/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml index 95db4b7555cf..5eaa7b998444 100644 --- a/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml @@ -1,6 +1,5 @@ documentation_complete: true - title: 'Verify Owner on the system journal' description: |- @@ -34,12 +33,15 @@ severity: medium fixtext: | {{%- if 'ubuntu' in product %}} Configure the system to set the appropriate ownership to the files - used by the systemd journal: - Add or modify the following lines in the "/etc/tmpfiles.d/systemd.conf" file: + used by the systemd journal. + Create the drop-in file "/etc/tmpfiles.d/zzz-systemd-stig.conf" with the + following content: 
+    Z /run/log/journal/%m ~0640 root systemd-journal - -
+    z /var/log/journal/%m 0640 root systemd-journal - -
     z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
- Restart the system for the changes to take effect. + Note: Restart the system for these settings to take effect. {{%- endif %}} references: diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/bash/ubuntu.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/bash/ubuntu.sh index 1e53e273926f..aed3541ccb6f 100644 --- a/linux_os/guide/system/logging/journald/file_permissions_system_journal/bash/ubuntu.sh +++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/bash/ubuntu.sh @@ -1,19 +1,3 @@ # platform = multi_platform_ubuntu -TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf" - -if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then - if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then - sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF" - fi - echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF" -fi - -systemd-tmpfiles --create +{{{ bash_set_journal_tmpfiles(2750) }}} diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml index 7ff0f057ac5b..8fd058be9851 100644 --- a/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml @@ -32,12 +32,17 @@ severity: medium fixtext: | {{%- if 'ubuntu' in product %}} Configure the system to set the appropriate permissions to the files and directories - used by the systemd journal: - Add or modify the following lines in the "/etc/tmpfiles.d/systemd.conf" file: + used by the systemd journal. + Create the drop-in file "/etc/tmpfiles.d/zzz-systemd-stig.conf" with the following + content: 
-    z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
+    z /run/log/journal 2750 root systemd-journal - -
+    Z /run/log/journal/%m ~2750 root systemd-journal - -
+    z /var/log/journal 2750 root systemd-journal - -
+    z /var/log/journal/%m 2750 root systemd-journal - -
+    z /var/log/journal/%m/system.journal 2750 root systemd-journal - -
- Restart the system for the changes to take effect. + Note: Restart the system for these settings to take effect. {{%- endif %}} references: @@ -65,4 +70,3 @@ template: filepath_is_regex: "true" {{%- endif %}} - diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja index 4feaa7a0bdcb..c30ab89d03f5 100644 --- a/shared/macros/10-bash.jinja +++ b/shared/macros/10-bash.jinja @@ -2895,3 +2895,42 @@ fi {{{ bash_replace_or_append(login_defs_drop_in_path, line_regex_replace, value, '%s %s', cce_identifiers=cce_identifiers) }}} {{%- endmacro %}} + +{{# + Set the ownership and permissions of the systemd journal directories + in tmpfiles.d drop-in. + +:parameter permission: permission to set +:type permission: str +#}} + +{{%- macro bash_set_journal_tmpfiles(permission) %}} +TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf" + +mkdir -p /etc/tmpfiles.d +touch "$TMPFILES_CONF" + +# Drop any previously written journal entries so stale or conflicting settings +# in this file cannot be applied after the hardened ones. +sed -i --follow-symlinks -E '/^[[:space:]]*[zZ][+]*[[:space:]]+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF" + +# A drop-in whose name sorts after this file would be applied last and would +# undo the hardening. Comment out journal entries in the other administrator +# drop-ins so the hardened entries below are the effective ones. +for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do + if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then + sed -i --follow-symlinks -E 's,^([[:space:]]*[zZ][+]*[[:space:]]+/(run|var)/log/journal.*),# \1,' "$conf" + fi +done + +cat >>"$TMPFILES_CONF" <<'EOF' +z /run/log/journal ~{{{ permission }}} root systemd-journal - - +Z /run/log/journal ~{{{ permission }}} root systemd-journal - - +z /run/log/journal/%m ~{{{ permission }}} root systemd-journal - - +z /var/log/journal ~{{{ permission }}} root systemd-journal - - +Z /var/log/journal ~{{{ permission }}} root systemd-journal - - +z /var/log/journal/%m ~{{{ permission }}} root systemd-journal - - +EOF + +systemd-tmpfiles --create +{{%- endmacro %}} From 309c8738383299c0116ea3fa29ca5a16a5ba330b Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Thu, 27 Aug 2026 13:07:40 +0100 Subject: [PATCH 2/8] Add tests Signed-off-by: Alan Moore --- .../dir_groupowner_system_journal/rule.yml | 10 +++++--- .../tests/correct_groupowner.pass.sh | 7 ++++++ .../tests/incorrect_groupowner.fail.sh | 9 ++++++++ .../tests/nested_subdir_groupowner.fail.sh | 11 +++++++++ .../tests/no_file.pass.sh | 7 ++++++ .../tests/correct_owner.pass.sh | 5 ++++ .../tests/incorrect_owner.fail.sh | 8 +++++++ .../tests/nested_subdir_owner.fail.sh | 11 +++++++++ .../tests/no_file.pass.sh | 5 ++++ .../tests/correct_permissions.pass.sh | 5 ++++ .../tests/lenient_permissions.fail.sh | 6 +++++ .../tests/nested_subdir_permissions.fail.sh | 12 ++++++++++ .../tests/no_file.pass.sh | 6 +++++ .../tests/stricter_permissions.pass.sh | 5 ++++ ...tmpfiles_early_filename_precedence.fail.sh | 22 ++++++++++++++++++ .../tests/tmpfiles_hardened_dropin.pass.sh | 23 +++++++++++++++++++ .../tmpfiles_late_filename_precedence.fail.sh | 19 +++++++++++++++ .../tmpfiles_line_type_precedence.fail.sh | 21 +++++++++++++++++ ...tmpfiles_runtime_dropin_precedence.fail.sh | 17 ++++++++++++++ .../tests/vendor_conf_precedence.fail.sh | 18 +++++++++++++++ .../tests/correct_groupowner.pass.sh | 9 ++++++++ .../tests/incorrect_groupowner.fail.sh | 8 +++++++ .../tests/nested_file_groupowner.fail.sh | 13 +++++++++++ .../tests/no_file.pass.sh | 7 ++++++ .../tests/correct_owner.pass.sh | 9 ++++++++ .../tests/incorrect_owner.fail.sh | 10 ++++++++ .../tests/nested_file_owner.fail.sh | 13 +++++++++++ .../tests/no_file.pass.sh | 8 +++++++ .../tests/correct_permissions.pass.sh | 10 ++++++++ .../tests/group_writable_file.fail.sh | 10 ++++++++ .../tests/no_file.pass.sh | 5 ++++ .../tests/setuid_file.fail.sh | 10 ++++++++ .../tests/stricter_permissions.pass.sh | 10 ++++++++ .../tests/world_readable_file.fail.sh | 10 ++++++++ .../tests/world_writable_file.fail.sh | 10 ++++++++ 35 files changed, 366 insertions(+), 3 deletions(-) create mode 100644 linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/correct_groupowner.pass.sh create mode 100644 linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/incorrect_groupowner.fail.sh create mode 100644 linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/nested_subdir_groupowner.fail.sh create mode 100644 linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/no_file.pass.sh create mode 100644 linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/correct_owner.pass.sh create mode 100644 linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/incorrect_owner.fail.sh create mode 100644 linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/nested_subdir_owner.fail.sh create mode 100644 linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/no_file.pass.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/correct_permissions.pass.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/lenient_permissions.fail.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/nested_subdir_permissions.fail.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/no_file.pass.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/stricter_permissions.pass.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_early_filename_precedence.fail.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_hardened_dropin.pass.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_late_filename_precedence.fail.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_line_type_precedence.fail.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_runtime_dropin_precedence.fail.sh create mode 100644 linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/vendor_conf_precedence.fail.sh create mode 100644 linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/correct_groupowner.pass.sh create mode 100644 linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/incorrect_groupowner.fail.sh create mode 100644 linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/nested_file_groupowner.fail.sh create mode 100644 linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/no_file.pass.sh create mode 100644 linux_os/guide/system/logging/journald/file_owner_system_journal/tests/correct_owner.pass.sh create mode 100644 linux_os/guide/system/logging/journald/file_owner_system_journal/tests/incorrect_owner.fail.sh create mode 100644 linux_os/guide/system/logging/journald/file_owner_system_journal/tests/nested_file_owner.fail.sh create mode 100644 linux_os/guide/system/logging/journald/file_owner_system_journal/tests/no_file.pass.sh create mode 100644 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/correct_permissions.pass.sh create mode 100644 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/group_writable_file.fail.sh create mode 100644 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/no_file.pass.sh create mode 100644 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/setuid_file.fail.sh create mode 100644 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/stricter_permissions.pass.sh create mode 100644 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/world_readable_file.fail.sh create mode 100644 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/world_writable_file.fail.sh diff --git a/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/rule.yml index 520a68e57725..29d798f8208a 100644 --- a/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/rule.yml @@ -21,13 +21,17 @@ severity: medium fixtext: | Configure the system to set the appropriate ownership to the directories - used by the systemd journal. Add or modify the following lines in the - "/usr/lib/tmpfiles.d/systemd.conf" file: + used by the systemd journal. + Create a drop-in file if it does not already exist with the following command: + 
+    $ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf
+
+ Add or modify the following lines in the "/usr/lib/tmpfiles.d/zzz-systemd-stig.conf" file: 
     z /run/log/journal 2640 root systemd-journal - -
     z /var/log/journal 2640 root systemd-journal - -
- Restart the system for the changes to take effect. + Note: Restart the system for the changes to take effect. template: name: file_groupowner diff --git a/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/correct_groupowner.pass.sh b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/correct_groupowner.pass.sh new file mode 100644 index 000000000000..eb8a569730ee --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/correct_groupowner.pass.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +getent group "systemd-journal" &>/dev/null || groupadd systemd-journal + +mkdir -p /run/log/journal /var/log/journal +chgrp -R systemd-journal /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/incorrect_groupowner.fail.sh b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/incorrect_groupowner.fail.sh new file mode 100644 index 000000000000..db024eb599b4 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/incorrect_groupowner.fail.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +getent group "systemd-journal" &>/dev/null || groupadd systemd-journal + +mkdir -p /run/log/journal /var/log/journal +mkdir -p /var/log/journal/wrong_group_dir +chgrp -R systemd-journal /run/log/journal /var/log/journal +chgrp -R nogroup /var/log/journal/wrong_group_dir diff --git a/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/nested_subdir_groupowner.fail.sh b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/nested_subdir_groupowner.fail.sh new file mode 100644 index 000000000000..a0b3c02fffcf --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/nested_subdir_groupowner.fail.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +getent group "systemd-journal" &>/dev/null || groupadd systemd-journal + +machine_id="$(cat /etc/machine-id)" +mkdir -p "/run/log/journal/${machine_id}/nested/deeper" +mkdir -p "/var/log/journal/${machine_id}/nested/deeper" + +chgrp nogroup "/run/log/journal/${machine_id}/nested/deeper" +chgrp nogroup "/var/log/journal/${machine_id}/nested/deeper" diff --git a/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/no_file.pass.sh b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/no_file.pass.sh new file mode 100644 index 000000000000..28147cf647dc --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/no_file.pass.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +getent group "systemd-journal" &>/dev/null || groupadd systemd-journal + +mkdir -p /run/log/journal /var/log/journal +chgrp systemd-journal /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/correct_owner.pass.sh b/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/correct_owner.pass.sh new file mode 100644 index 000000000000..5c43a2066188 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/correct_owner.pass.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +mkdir -p /run/log/journal /var/log/journal +chown -R root /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/incorrect_owner.fail.sh b/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/incorrect_owner.fail.sh new file mode 100644 index 000000000000..0cf5454912c1 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/incorrect_owner.fail.sh @@ -0,0 +1,8 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +useradd testuser_123 + +mkdir -p /run/log/journal /var/log/journal +mkdir -p /run/log/journal/wrong_owner_dir +chown -R testuser_123 /run/log/journal/wrong_owner_dir diff --git a/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/nested_subdir_owner.fail.sh b/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/nested_subdir_owner.fail.sh new file mode 100644 index 000000000000..a295133eb506 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/nested_subdir_owner.fail.sh @@ -0,0 +1,11 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +id testuser_123 &>/dev/null || useradd testuser_123 + +machine_id="$(cat /etc/machine-id)" +mkdir -p "/run/log/journal/${machine_id}/nested/deeper" +mkdir -p "/var/log/journal/${machine_id}/nested/deeper" + +chown testuser_123 "/run/log/journal/${machine_id}/nested/deeper" +chown testuser_123 "/var/log/journal/${machine_id}/nested/deeper" diff --git a/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/no_file.pass.sh b/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/no_file.pass.sh new file mode 100644 index 000000000000..3010d85c3d68 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/no_file.pass.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +mkdir -p /run/log/journal /var/log/journal +chown root /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/correct_permissions.pass.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/correct_permissions.pass.sh new file mode 100644 index 000000000000..e5a0c28d7872 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/correct_permissions.pass.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +mkdir -p /run/log/journal /var/log/journal +find /run/log/journal /var/log/journal -type d -exec chmod 2750 {} \; diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/lenient_permissions.fail.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/lenient_permissions.fail.sh new file mode 100644 index 000000000000..4c768d32faf6 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/lenient_permissions.fail.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +mkdir -p /run/log/journal /var/log/journal +mkdir -p /run/log/journal/loose_dir +chmod 777 /run/log/journal/loose_dir diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/nested_subdir_permissions.fail.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/nested_subdir_permissions.fail.sh new file mode 100644 index 000000000000..1330b8b5ca38 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/nested_subdir_permissions.fail.sh @@ -0,0 +1,12 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +machine_id="$(cat /etc/machine-id)" + +mkdir -p "/run/log/journal/${machine_id}/nested/deeper" +mkdir -p "/var/log/journal/${machine_id}/nested/deeper" + +chmod 2755 "/run/log/journal/${machine_id}/nested" +chmod 2777 "/run/log/journal/${machine_id}/nested/deeper" +chmod 2755 "/var/log/journal/${machine_id}/nested" +chmod 2777 "/var/log/journal/${machine_id}/nested/deeper" diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/no_file.pass.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/no_file.pass.sh new file mode 100644 index 000000000000..343bdc845422 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/no_file.pass.sh @@ -0,0 +1,6 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +mkdir -p /run/log/journal /var/log/journal +rm -rf /run/log/journal/* /var/log/journal/* +chmod 2750 /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/stricter_permissions.pass.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/stricter_permissions.pass.sh new file mode 100644 index 000000000000..f9535d422b01 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/stricter_permissions.pass.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +mkdir -p /run/log/journal /var/log/journal +find /run/log/journal /var/log/journal -type d -exec chmod 0700 {} \; diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_early_filename_precedence.fail.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_early_filename_precedence.fail.sh new file mode 100644 index 000000000000..753e3ddbb17b --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_early_filename_precedence.fail.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +# Precedence dimension: FILE NAME ordering. +# +# Configuration files are read from /etc/tmpfiles.d, /run/tmpfiles.d and +# /usr/lib/tmpfiles.d and are sorted by file name regardless of the directory +# they live in. Because z/Z entries adjust permissions of existing inodes, every +# matching entry is applied and the one applied last wins. A drop-in that sorts +# *before* the vendor systemd.conf is therefore overridden by it. +# +# Place a hardening drop-in under a name that sorts before "systemd.conf" so it +# loses against the vendor entry, together with a loose drop-in that sorts after +# it. The remediation writes "zzz-systemd-stig.conf", which sorts last and wins. +mkdir -p /etc/tmpfiles.d +cat > /etc/tmpfiles.d/00-journal-hardening.conf <<'EOF' +z /run/log/journal 2750 root systemd-journal - - +z /var/log/journal 2750 root systemd-journal - - +EOF + +mkdir -p /run/log/journal /var/log/journal +chmod 2755 /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_hardened_dropin.pass.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_hardened_dropin.pass.sh new file mode 100644 index 000000000000..817ef90d5af2 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_hardened_dropin.pass.sh @@ -0,0 +1,23 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +# Precedence dimension: correctly ordered drop-in (positive case). +# +# A drop-in that sorts after the vendor systemd.conf and repeats the vendor line +# types and paths wins, because for z/Z entries every matching entry is applied +# and the entry applied last takes effect. Non-recursive "z" entries are applied +# after recursive "Z" entries, which is why the plain "z" lines are required in +# addition to the recursive ones. +mkdir -p /etc/tmpfiles.d +cat > /etc/tmpfiles.d/zzz-systemd-stig.conf <<'EOF' +z /run/log/journal ~2750 root systemd-journal - - +Z /run/log/journal ~2750 root systemd-journal - - +z /run/log/journal/%m ~2750 root systemd-journal - - +z /var/log/journal ~2750 root systemd-journal - - +Z /var/log/journal ~2750 root systemd-journal - - +z /var/log/journal/%m ~2750 root systemd-journal - - +EOF + +mkdir -p /run/log/journal /var/log/journal +chmod 2755 /run/log/journal /var/log/journal +systemd-tmpfiles --create diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_late_filename_precedence.fail.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_late_filename_precedence.fail.sh new file mode 100644 index 000000000000..91a2789c66bf --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_late_filename_precedence.fail.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +# Precedence dimension: FILE NAME ordering, drop-in sorting AFTER the drop-in +# written by the remediation. +# +# Because z/Z entries are applied to already existing inodes, systemd-tmpfiles +# applies every matching entry and the entry applied last wins. A drop-in that +# sorts after "zzz-systemd-stig.conf" would therefore be applied last and would +# reset the journal directories back to a too permissive mode. The remediation +# neutralizes conflicting journal entries in the other drop-ins. +mkdir -p /etc/tmpfiles.d +cat > /etc/tmpfiles.d/zzzz-late-override.conf <<'EOF' +z /run/log/journal 2755 root systemd-journal - - +z /var/log/journal 2755 root systemd-journal - - +EOF + +mkdir -p /run/log/journal /var/log/journal +chmod 2755 /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_line_type_precedence.fail.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_line_type_precedence.fail.sh new file mode 100644 index 000000000000..5a027fb91119 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_line_type_precedence.fail.sh @@ -0,0 +1,21 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +# Precedence dimension: LINE TYPE. +# +# systemd ships /usr/lib/tmpfiles.d/systemd.conf with a non-recursive +# "z /run/log/journal 2755" entry. For z/Z lines systemd-tmpfiles applies every +# matching entry instead of de-duplicating them, and non-recursive "z" lines are +# applied after recursive "Z" lines. A drop-in that only carries recursive "Z" +# lines is therefore overridden by the vendor "z" entry and the directories stay +# at 2755. The remediation must emit matching "z" lines as well. +# +# Re-create the vendor situation and leave a drop-in that only uses "Z". +mkdir -p /etc/tmpfiles.d +cat > /etc/tmpfiles.d/zzz-systemd-stig.conf <<'EOF' +Z /run/log/journal ~2750 root systemd-journal - - +Z /var/log/journal ~2750 root systemd-journal - - +EOF + +mkdir -p /run/log/journal /var/log/journal +chmod 2755 /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_runtime_dropin_precedence.fail.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_runtime_dropin_precedence.fail.sh new file mode 100644 index 000000000000..dcd489304e0a --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_runtime_dropin_precedence.fail.sh @@ -0,0 +1,17 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +# Precedence dimension: CONFIGURATION DIRECTORY. +# +# Configuration is read from /etc/tmpfiles.d, /run/tmpfiles.d and +# /usr/lib/tmpfiles.d, and the files of all three directories are sorted +# together by file name. A loose entry dropped into /run/tmpfiles.d under a name +# that sorts last is therefore applied after the hardened entry. +mkdir -p /run/tmpfiles.d +cat > /run/tmpfiles.d/zzzzz-runtime-override.conf <<'EOF' +z /run/log/journal 2777 root systemd-journal - - +z /var/log/journal 2777 root systemd-journal - - +EOF + +mkdir -p /run/log/journal /var/log/journal +chmod 2777 /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/vendor_conf_precedence.fail.sh b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/vendor_conf_precedence.fail.sh new file mode 100644 index 000000000000..e31aab16b269 --- /dev/null +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/vendor_conf_precedence.fail.sh @@ -0,0 +1,18 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +# Precedence dimension: VENDOR configuration in /usr/lib/tmpfiles.d. +# +# systemd ships /usr/lib/tmpfiles.d/systemd.conf, which contains +# z /run/log/journal 2755 root systemd-journal - - +# z /var/log/journal 2755 root systemd-journal - - +# z /var/log/journal/%m 2755 root systemd-journal - - +# so a stock system ends up with the too permissive mode 2755 as soon as +# systemd-tmpfiles runs. The vendor file must not be edited, the hardened +# entries have to be shipped in a drop-in that is applied after it. +# +# Reproduce the stock state and remove any hardening drop-in. +rm -f /etc/tmpfiles.d/zzz-systemd-stig.conf + +mkdir -p /run/log/journal /var/log/journal +find /run/log/journal /var/log/journal -type d -exec chmod 2755 {} \; diff --git a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/correct_groupowner.pass.sh b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/correct_groupowner.pass.sh new file mode 100644 index 000000000000..a225278c7ec5 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/correct_groupowner.pass.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +getent group "systemd-journal" &>/dev/null || groupadd systemd-journal + +mkdir -p /run/log/journal /var/log/journal +touch /var/log/journal/system.journal +touch /run/log/journal/system.journal +chgrp -R systemd-journal /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/incorrect_groupowner.fail.sh b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/incorrect_groupowner.fail.sh new file mode 100644 index 000000000000..5a1625e39305 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/incorrect_groupowner.fail.sh @@ -0,0 +1,8 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +getent group "systemd-journal" &>/dev/null || groupadd systemd-journal + +mkdir -p /run/log/journal +touch /run/log/journal/system.journal +chgrp nogroup /run/log/journal/system.journal diff --git a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/nested_file_groupowner.fail.sh b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/nested_file_groupowner.fail.sh new file mode 100644 index 000000000000..dff9f02c9726 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/nested_file_groupowner.fail.sh @@ -0,0 +1,13 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +getent group "systemd-journal" &>/dev/null || groupadd systemd-journal + +machine_id="$(cat /etc/machine-id)" +mkdir -p "/run/log/journal/${machine_id}/nested/deeper" +mkdir -p "/var/log/journal/${machine_id}/nested/deeper" + +touch "/run/log/journal/${machine_id}/nested/deeper/user-1000.journal" +touch "/var/log/journal/${machine_id}/nested/deeper/user-1000.journal" +chgrp nogroup "/run/log/journal/${machine_id}/nested/deeper/user-1000.journal" +chgrp nogroup "/var/log/journal/${machine_id}/nested/deeper/user-1000.journal" diff --git a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/no_file.pass.sh b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/no_file.pass.sh new file mode 100644 index 000000000000..28147cf647dc --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/tests/no_file.pass.sh @@ -0,0 +1,7 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +getent group "systemd-journal" &>/dev/null || groupadd systemd-journal + +mkdir -p /run/log/journal /var/log/journal +chgrp systemd-journal /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/correct_owner.pass.sh b/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/correct_owner.pass.sh new file mode 100644 index 000000000000..232a9197f2b8 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/correct_owner.pass.sh @@ -0,0 +1,9 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +mkdir -p /run/log/journal /var/log/journal +# Create dummy journal files so the recursive file ownership check has +# something to scan, and make everything owned by root. +touch /var/log/journal/system.journal +touch /run/log/journal/system.journal +chown -R root /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/incorrect_owner.fail.sh b/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/incorrect_owner.fail.sh new file mode 100644 index 000000000000..ae6f5e0fa86e --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/incorrect_owner.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +useradd testuser_123 + +mkdir -p /run/log/journal +# Create a dummy journal file owned by a user other than root so the +# recursive file ownership check fails. +touch /run/log/journal/system.journal +chown testuser_123 /run/log/journal/system.journal diff --git a/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/nested_file_owner.fail.sh b/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/nested_file_owner.fail.sh new file mode 100644 index 000000000000..52f4fcbc3ab3 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/nested_file_owner.fail.sh @@ -0,0 +1,13 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +id testuser_123 &>/dev/null || useradd testuser_123 + +machine_id="$(cat /etc/machine-id)" +mkdir -p "/run/log/journal/${machine_id}/nested/deeper" +mkdir -p "/var/log/journal/${machine_id}/nested/deeper" + +touch "/run/log/journal/${machine_id}/nested/deeper/user-1000.journal" +touch "/var/log/journal/${machine_id}/nested/deeper/user-1000.journal" +chown testuser_123 "/run/log/journal/${machine_id}/nested/deeper/user-1000.journal" +chown testuser_123 "/var/log/journal/${machine_id}/nested/deeper/user-1000.journal" diff --git a/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/no_file.pass.sh b/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/no_file.pass.sh new file mode 100644 index 000000000000..cd4ec1d9cce4 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_owner_system_journal/tests/no_file.pass.sh @@ -0,0 +1,8 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +# Create the journal directories (root-owned) but leave them empty so the +# recursive file ownership scan finds nothing to flag (PASS, not +# NOTAPPLICABLE). +mkdir -p /run/log/journal /var/log/journal +chown root /run/log/journal /var/log/journal diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/correct_permissions.pass.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/correct_permissions.pass.sh new file mode 100644 index 000000000000..19a1ddf5034f --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/correct_permissions.pass.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +mkdir -p /run/log/journal /var/log/journal +find /run/log/journal /var/log/journal -type f -exec chmod 0640 {} \; + +machine_id="$(cat /etc/machine-id)" +mkdir -p "/var/log/journal/${machine_id}" +touch "/var/log/journal/${machine_id}/system.journal" +chmod 0640 "/var/log/journal/${machine_id}/system.journal" diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/group_writable_file.fail.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/group_writable_file.fail.sh new file mode 100644 index 000000000000..483be2cd9b69 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/group_writable_file.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +machine_id="$(cat /etc/machine-id)" +mkdir -p "/run/log/journal/${machine_id}" "/var/log/journal/${machine_id}" + +touch "/run/log/journal/${machine_id}/user-1000.journal" +touch "/var/log/journal/${machine_id}/user-1000.journal" +chmod 0660 "/run/log/journal/${machine_id}/user-1000.journal" +chmod 0660 "/var/log/journal/${machine_id}/user-1000.journal" diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/no_file.pass.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/no_file.pass.sh new file mode 100644 index 000000000000..0f35063648c3 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/no_file.pass.sh @@ -0,0 +1,5 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +mkdir -p /run/log/journal /var/log/journal +find /run/log/journal /var/log/journal -type f -delete diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/setuid_file.fail.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/setuid_file.fail.sh new file mode 100644 index 000000000000..733e4d0a44a5 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/setuid_file.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +machine_id="$(cat /etc/machine-id)" +mkdir -p "/run/log/journal/${machine_id}" "/var/log/journal/${machine_id}" + +touch "/run/log/journal/${machine_id}/user-1000.journal" +touch "/var/log/journal/${machine_id}/user-1000.journal" +chmod 4640 "/run/log/journal/${machine_id}/user-1000.journal" +chmod 4640 "/var/log/journal/${machine_id}/user-1000.journal" diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/stricter_permissions.pass.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/stricter_permissions.pass.sh new file mode 100644 index 000000000000..635f40b7674e --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/stricter_permissions.pass.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +mkdir -p /run/log/journal /var/log/journal +find /run/log/journal /var/log/journal -type f -exec chmod 0600 {} \; + +machine_id="$(cat /etc/machine-id)" +mkdir -p "/var/log/journal/${machine_id}" +touch "/var/log/journal/${machine_id}/system.journal" +chmod 0600 "/var/log/journal/${machine_id}/system.journal" diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/world_readable_file.fail.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/world_readable_file.fail.sh new file mode 100644 index 000000000000..1a852acb2b05 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/world_readable_file.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +machine_id="$(cat /etc/machine-id)" +mkdir -p "/run/log/journal/${machine_id}" "/var/log/journal/${machine_id}" + +touch "/run/log/journal/${machine_id}/user-1000.journal" +touch "/var/log/journal/${machine_id}/user-1000.journal" +chmod 0644 "/run/log/journal/${machine_id}/user-1000.journal" +chmod 0644 "/var/log/journal/${machine_id}/user-1000.journal" diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/world_writable_file.fail.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/world_writable_file.fail.sh new file mode 100644 index 000000000000..6ac24335d0a3 --- /dev/null +++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/world_writable_file.fail.sh @@ -0,0 +1,10 @@ +#!/bin/bash +# platform = multi_platform_ubuntu + +machine_id="$(cat /etc/machine-id)" +mkdir -p "/run/log/journal/${machine_id}" "/var/log/journal/${machine_id}" + +touch "/run/log/journal/${machine_id}/user-1000.journal" +touch "/var/log/journal/${machine_id}/user-1000.journal" +chmod 0666 "/run/log/journal/${machine_id}/user-1000.journal" +chmod 0666 "/var/log/journal/${machine_id}/user-1000.journal" From f73bdc762cfdc2d45e0807ea291763e542b2dd66 Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Mon, 31 Aug 2026 15:58:36 +0100 Subject: [PATCH 3/8] Fix yamllint errors --- .../file_groupowner_system_journal/rule.yml | 14 +++++--------- .../journald/file_owner_system_journal/rule.yml | 4 ++-- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml index 530a2e760b3a..47e1879ba021 100644 --- a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml @@ -23,7 +23,6 @@ rationale: |- messages to unauthorized personnel or their designated representatives. {{%- else %}} RHCOS must protect system journal file from any type of unauthorized access by setting file group ownership. - {{%- endif %}} identifiers: @@ -34,15 +33,12 @@ severity: medium fixtext: | {{%- if 'ubuntu' in product %}} Configure the system to set the appropriate group-ownership to the files - used by the systemd journal. - Create the drop-in file "/etc/tmpfiles.d/zzz-systemd-stig.conf" with the - following content: + used by the systemd journal: + Add or modify the following lines in the "/etc/tmpfiles.d/systemd.conf" file: 
-    Z /run/log/journal/%m ~0640 root systemd-journal - -
-    z /var/log/journal/%m 0640 root systemd-journal - -
     z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
- Note: Restart the system for these settings to take effect. + Restart the system for the changes to take effect. {{%- endif %}} references: @@ -58,8 +54,8 @@ template: vars: {{%- if 'ubuntu' in product %}} filepath: - - /run/log/journal/ - - /var/log/journal/ + - /run/log/journal/ + - /var/log/journal/ recursive: 'true' file_regex: ^.*$ gid_or_name: systemd-journal diff --git a/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml index 5eaa7b998444..67e920eed493 100644 --- a/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml @@ -57,8 +57,8 @@ template: vars: {{%- if 'ubuntu' in product %}} filepath: - - /run/log/journal/ - - /var/log/journal/ + - /run/log/journal/ + - /var/log/journal/ recursive: 'true' file_regex: ^.*$ uid_or_name: '0' From 5ad9fb33d7ae50e166b78cd8d169401a454f76dd Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Mon, 31 Aug 2026 16:46:28 +0100 Subject: [PATCH 4/8] Remove unused templates Signed-off-by: Alan Moore --- .../file_groupowner_system_journal/rule.yml | 20 ++++++------------- .../file_owner_system_journal/rule.yml | 11 ---------- .../file_permissions_system_journal/rule.yml | 11 ---------- 3 files changed, 6 insertions(+), 36 deletions(-) diff --git a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml index 47e1879ba021..f9d9fbaa8c4e 100644 --- a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml @@ -33,12 +33,15 @@ severity: medium fixtext: | {{%- if 'ubuntu' in product %}} Configure the system to set the appropriate group-ownership to the files - used by the systemd journal: - Add or modify the following lines in the "/etc/tmpfiles.d/systemd.conf" file: + used by the systemd journal. + Create the drop-in file "/etc/tmpfiles.d/zzz-systemd-stig.conf" with the + following content: 
+    Z /run/log/journal/%m ~0640 root systemd-journal - -
+    z /var/log/journal/%m 0640 root systemd-journal - -
     z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
- Restart the system for the changes to take effect. + Note: Restart the system for these settings to take effect. {{%- endif %}} references: @@ -52,17 +55,6 @@ ocil: |- template: name: file_groupowner vars: - {{%- if 'ubuntu' in product %}} - filepath: - - /run/log/journal/ - - /var/log/journal/ - recursive: 'true' - file_regex: ^.*$ - gid_or_name: systemd-journal - - {{%- else %}} filepath: ^/var/log/journal/.*/system.journal$ gid_or_name: systemd-journal filepath_is_regex: "true" - - {{%- endif %}} diff --git a/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml index 67e920eed493..b03b84835fba 100644 --- a/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml @@ -55,17 +55,6 @@ ocil: |- template: name: file_owner vars: - {{%- if 'ubuntu' in product %}} - filepath: - - /run/log/journal/ - - /var/log/journal/ - recursive: 'true' - file_regex: ^.*$ - uid_or_name: '0' - - {{%- else %}} filepath: ^/var/log/journal/.*/system.journal$ uid_or_name: '0' filepath_is_regex: "true" - - {{%- endif %}} diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml index 8fd058be9851..90b4f6f32440 100644 --- a/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml @@ -56,17 +56,6 @@ ocil: |- template: name: file_permissions vars: - {{%- if 'ubuntu' in product %}} - filepath: - - /run/log/journal/ - - /var/log/journal/ - recursive: 'true' - file_regex: ^.*$ - filemode: '0640' - - {{%- else %}} filepath: ^/var/log/journal/.*/system.journal$ filemode: '0640' filepath_is_regex: "true" - - {{%- endif %}} From 7dcc840ccd92599a14cdc2bf72e70404b026ffbd Mon Sep 17 00:00:00 2001 From: Alan Moore Date: Wed, 2 Sep 2026 08:48:53 +0100 Subject: [PATCH 5/8] Small adjustment of rule.yml Signed-off-by: Alan Moore --- .../logging/journald/dir_groupowner_system_journal/rule.yml | 6 +++--- .../journald/dir_permissions_system_journal/rule.yml | 4 ++-- .../journald/file_permissions_system_journal/rule.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/rule.yml index 29d798f8208a..75f01be89740 100644 --- a/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/rule.yml @@ -26,10 +26,10 @@ fixtext: | 
     $ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf
- Add or modify the following lines in the "/usr/lib/tmpfiles.d/zzz-systemd-stig.conf" file: + Add or modify the following lines in the "/etc/tmpfiles.d/zzz-systemd-stig.conf" file: 
-    z /run/log/journal 2640 root systemd-journal - -
-    z /var/log/journal 2640 root systemd-journal - -
+    z /run/log/journal 0640 root systemd-journal - -
+    z /var/log/journal 0640 root systemd-journal - -
Note: Restart the system for the changes to take effect. diff --git a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/rule.yml b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/rule.yml index 1c8106591eed..590f637cca8a 100644 --- a/linux_os/guide/system/logging/journald/dir_permissions_system_journal/rule.yml +++ b/linux_os/guide/system/logging/journald/dir_permissions_system_journal/rule.yml @@ -18,13 +18,13 @@ rationale: |- severity: medium fixtext: | - Configure the system to set the appropriate permissions to the files and directories + Configure the system to set the appropriate permissions to the directories used by the systemd journal. Create a drop-in file, if it does not already exist with the following command: 
     $ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf
- Add or modify the following lines in the "/usr/lib/tmpfiles.d/zzz-systemd-stig.conf" file: + Add or modify the following lines in the "/etc/tmpfiles.d/zzz-systemd-stig.conf" file: 
     z /run/log/journal 2750 root systemd-journal - -
     Z /run/log/journal/%m ~2750 root systemd-journal - -
diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml
index 90b4f6f32440..700ee81191eb 100644
--- a/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml
+++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml
@@ -31,7 +31,7 @@ severity: medium
 
 fixtext: |
     {{%- if 'ubuntu' in product %}}
-    Configure the system to set the appropriate permissions to the files and directories
+    Configure the system to set the appropriate permissions to the files
     used by the systemd journal.
     Create the drop-in file "/etc/tmpfiles.d/zzz-systemd-stig.conf" with the following
     content:

From 80edf4b6edd6af7a166a05047ba9127733e3fc0d Mon Sep 17 00:00:00 2001
From: Alan Moore 
Date: Wed, 2 Sep 2026 08:51:47 +0100
Subject: [PATCH 6/8] Add more tests for file permission

Signed-off-by: Alan Moore 
---
 .../tests/deep_file.fail.sh                          | 12 ++++++++++++
 .../tests/executable_file.fail.sh                    | 11 +++++++++++
 .../tests/namespace_file.fail.sh                     | 12 ++++++++++++
 .../tests/unexpected_name_file.fail.sh               |  8 ++++++++
 4 files changed, 43 insertions(+)
 create mode 100644 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/deep_file.fail.sh
 create mode 100755 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/executable_file.fail.sh
 create mode 100644 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/namespace_file.fail.sh
 create mode 100644 linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/unexpected_name_file.fail.sh

diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/deep_file.fail.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/deep_file.fail.sh
new file mode 100644
index 000000000000..9f8d3e10b4bf
--- /dev/null
+++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/deep_file.fail.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+machine_id=$(cat /etc/machine-id)
+deep_dir="/var/log/journal/${machine_id}/nested/deeper"
+
+mkdir -p "$deep_dir"
+chown root:systemd-journal "$deep_dir" "/var/log/journal/${machine_id}/nested"
+chmod 2750 "$deep_dir" "/var/log/journal/${machine_id}/nested"
+
+install -m 0750 -o root -g systemd-journal /dev/null \
+    "${deep_dir}/system@deadbeef.journal"
diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/executable_file.fail.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/executable_file.fail.sh
new file mode 100755
index 000000000000..1d9f81a4877e
--- /dev/null
+++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/executable_file.fail.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+MACHINE_ID="$(cat /etc/machine-id)"
+JOURNAL_DIR="/var/log/journal/${MACHINE_ID}"
+JOURNAL_FILE="${JOURNAL_DIR}/user-1000@0005f97cd4a8c9b5-f088232c3718485a.journal~"
+
+mkdir -p "${JOURNAL_DIR}"
+touch "${JOURNAL_FILE}"
+chown root:systemd-journal "${JOURNAL_FILE}"
+chmod 0750 "${JOURNAL_FILE}"
diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/namespace_file.fail.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/namespace_file.fail.sh
new file mode 100644
index 000000000000..61dcbe02ced1
--- /dev/null
+++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/namespace_file.fail.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+machine_id=$(cat /etc/machine-id)
+namespace_dir="/var/log/journal/${machine_id}.testnamespace"
+
+mkdir -p "$namespace_dir"
+chown root:systemd-journal "$namespace_dir"
+chmod 2750 "$namespace_dir"
+
+install -m 0750 -o root -g systemd-journal /dev/null \
+    "${namespace_dir}/system.journal"
diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/unexpected_name_file.fail.sh b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/unexpected_name_file.fail.sh
new file mode 100644
index 000000000000..1ee2b2a23148
--- /dev/null
+++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/tests/unexpected_name_file.fail.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+machine_id=$(cat /etc/machine-id)
+
+mkdir -p "/var/log/journal/${machine_id}"
+install -m 0750 -o root -g systemd-journal /dev/null \
+    "/var/log/journal/${machine_id}/leftover.log"

From 3b55f62b218eba34ffe5d5bb92cfad6d56b333af Mon Sep 17 00:00:00 2001
From: Alan Moore 
Date: Wed, 2 Sep 2026 08:57:12 +0100
Subject: [PATCH 7/8] Make bash remediation more rigorous

Signed-off-by: Alan Moore 
---
 shared/macros/10-bash.jinja | 35 +++++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja
index c30ab89d03f5..5f5b69beeddb 100644
--- a/shared/macros/10-bash.jinja
+++ b/shared/macros/10-bash.jinja
@@ -2900,11 +2900,34 @@ fi
     Set the ownership and permissions of the systemd journal directories
     in tmpfiles.d drop-in.
 
-:parameter permission: permission to set
+    The directory entries have to keep the executable bits, otherwise the
+    journal directories cannot be traversed. The journal files must not be
+    executable, so they need their own entries: the tilde only masks bits away,
+    so a recursive Z carrying the directory mode leaves an already executable
+    journal file executable, and the file rule then reports a finding that the
+    remediation cannot fix.
+
+    The file entries match one directory level, which is where journald keeps
+    the journal files. They match %m* rather than %m because a journal
+    namespace stores its files in /var/log/journal/MACHINE_ID.NAMESPACE, and
+    those files would otherwise only be covered by the recursive directory
+    entry and stay executable. tmpfiles.d cannot express more than one level:
+    the glob is matched one path component at a time, so there is no recursive
+    form, and the recursion of Z applies to directories as well, which would
+    strip the     executable bits the journal directories need. A journal file that sits at a
+    greater depth or under an unexpected name is therefore corrected by a find
+    pass instead, because the check scans the trees recursively and would
+    otherwise report a finding that the remediation cannot fix. The tmpfiles.d
+    entries keep the ordinary layout correct across reboots, the find pass
+    repairs whatever else is already on disk.
+
+:parameter permission: permission to set on the journal directories
 :type permission: str
+:parameter file_permission: permission to set on the journal files
+:type file_permission: str
 #}}
 
-{{%- macro bash_set_journal_tmpfiles(permission) %}}
+{{%- macro bash_set_journal_tmpfiles(permission, file_permission='0640') %}}
 TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
 mkdir -p /etc/tmpfiles.d
@@ -2912,14 +2935,14 @@ touch "$TMPFILES_CONF"
 
 # Drop any previously written journal entries so stale or conflicting settings
 # in this file cannot be applied after the hardened ones.
-sed -i --follow-symlinks -E '/^[[:space:]]*[zZ][+]*[[:space:]]+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+sed -i --follow-symlinks -E '/^\s*[zZ][+]*\s+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
 
 # A drop-in whose name sorts after this file would be applied last and would
 # undo the hardening. Comment out journal entries in the other administrator
 # drop-ins so the hardened entries below are the effective ones.
 for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
     if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
-        sed -i --follow-symlinks -E 's,^([[:space:]]*[zZ][+]*[[:space:]]+/(run|var)/log/journal.*),# \1,' "$conf"
+        sed -i --follow-symlinks -E 's,^(\s*[zZ][+]*\s+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
 done
 
@@ -2930,7 +2953,11 @@ z /run/log/journal/%m ~{{{ permission }}} root systemd-journal - -
 z /var/log/journal ~{{{ permission }}} root systemd-journal - -
 Z /var/log/journal ~{{{ permission }}} root systemd-journal - -
 z /var/log/journal/%m ~{{{ permission }}} root systemd-journal - -
+Z /run/log/journal/%m*/*.journal* ~{{{ file_permission }}} root systemd-journal - -
+Z /var/log/journal/%m*/*.journal* ~{{{ file_permission }}} root systemd-journal - -
 EOF
 
 systemd-tmpfiles --create
+
+find /run/log/journal /var/log/journal -type f -exec chmod u-x,g-wx,o-rwx {} +
 {{%- endmacro %}}

From 5b397e61ddcf56407bbacab45538796ad385f11c Mon Sep 17 00:00:00 2001
From: Alan Moore 
Date: Wed, 2 Sep 2026 10:00:28 +0100
Subject: [PATCH 8/8] Make oval check more rigorous

Signed-off-by: Alan Moore 
---
 .../journald/file_groupowner_system_journal/rule.yml  | 11 +++++++++++
 .../journald/file_owner_system_journal/rule.yml       | 11 +++++++++++
 .../journald/file_permissions_system_journal/rule.yml | 11 +++++++++++
 3 files changed, 33 insertions(+)

diff --git a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml
index f9d9fbaa8c4e..6951dc08d6a3 100644
--- a/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml
+++ b/linux_os/guide/system/logging/journald/file_groupowner_system_journal/rule.yml
@@ -55,6 +55,17 @@ ocil: |-
 template:
     name: file_groupowner
     vars:
+        {{%- if 'ubuntu' in product %}}
+        filepath:
+            - /run/log/journal/
+            - /var/log/journal/
+        file_regex:
+            - ^.*$
+            - ^.*$
+        recursive: 'true'
+        gid_or_name: systemd-journal
+        {{%- else %}}
         filepath: ^/var/log/journal/.*/system.journal$
         gid_or_name: systemd-journal
         filepath_is_regex: "true"
+        {{%- endif %}}
diff --git a/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml
index b03b84835fba..dce8db8ba8c6 100644
--- a/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml
+++ b/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml
@@ -55,6 +55,17 @@ ocil: |-
 template:
     name: file_owner
     vars:
+        {{%- if 'ubuntu' in product %}}
+        filepath:
+            - /run/log/journal/
+            - /var/log/journal/
+        file_regex:
+            - ^.*$
+            - ^.*$
+        recursive: 'true'
+        uid_or_name: '0'
+        {{%- else %}}
         filepath: ^/var/log/journal/.*/system.journal$
         uid_or_name: '0'
         filepath_is_regex: "true"
+        {{%- endif %}}
diff --git a/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml b/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml
index 700ee81191eb..76c9ecf85e89 100644
--- a/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml
+++ b/linux_os/guide/system/logging/journald/file_permissions_system_journal/rule.yml
@@ -56,6 +56,17 @@ ocil: |-
 template:
     name: file_permissions
     vars:
+        {{%- if 'ubuntu' in product %}}
+        filepath:
+            - /run/log/journal/
+            - /var/log/journal/
+        file_regex:
+            - ^.*$
+            - ^.*$
+        recursive: 'true'
+        filemode: '0640'
+        {{%- else %}}
         filepath: ^/var/log/journal/.*/system.journal$
         filemode: '0640'
         filepath_is_regex: "true"
+        {{%- endif %}}