[Ubuntu] Fix tmpfiles.d rules

linux_os/guide/system/logging/journald/dir_groupowner_system_journal/bash/ubuntu.sh

@@ -1,19 +1,3 @@
 # platform = multi_platform_ubuntu
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
-
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
-
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
-
-systemd-tmpfiles --create
+{{{ bash_set_journal_tmpfiles(2750) }}}

linux_os/guide/system/logging/journald/dir_groupowner_system_journal/rule.yml

@@ -21,13 +21,17 @@ severity: medium
 
 fixtext: |
     Configure the system to set the appropriate ownership to the directories
-    used by the systemd journal. Add or modify the following lines in the
-    "/usr/lib/tmpfiles.d/systemd.conf" file:
+    used by the systemd journal.
+    Create a drop-in file if it does not already exist with the following command:
     <pre>
-    z /run/log/journal 2640 root systemd-journal - -
-    z /var/log/journal 2640 root systemd-journal - -
+    $ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf
     </pre>
-    Restart the system for the changes to take effect.
+    Add or modify the following lines in the "/etc/tmpfiles.d/zzz-systemd-stig.conf" file:
+    <pre>
+    z /run/log/journal 0640 root systemd-journal - -
+    z /var/log/journal 0640 root systemd-journal - -
+    </pre>
+    Note: Restart the system for the changes to take effect.
 
 template:
     name: file_groupowner

linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/correct_groupowner.pass.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+getent group "systemd-journal" &>/dev/null || groupadd systemd-journal
+
+mkdir -p /run/log/journal /var/log/journal
+chgrp -R systemd-journal /run/log/journal /var/log/journal

linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/incorrect_groupowner.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+getent group "systemd-journal" &>/dev/null || groupadd systemd-journal
+
+mkdir -p /run/log/journal /var/log/journal
+mkdir -p /var/log/journal/wrong_group_dir
+chgrp -R systemd-journal /run/log/journal /var/log/journal
+chgrp -R nogroup /var/log/journal/wrong_group_dir

linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/nested_subdir_groupowner.fail.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+getent group "systemd-journal" &>/dev/null || groupadd systemd-journal
+
+machine_id="$(cat /etc/machine-id)"
+mkdir -p "/run/log/journal/${machine_id}/nested/deeper"
+mkdir -p "/var/log/journal/${machine_id}/nested/deeper"
+
+chgrp nogroup "/run/log/journal/${machine_id}/nested/deeper"
+chgrp nogroup "/var/log/journal/${machine_id}/nested/deeper"

linux_os/guide/system/logging/journald/dir_groupowner_system_journal/tests/no_file.pass.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+getent group "systemd-journal" &>/dev/null || groupadd systemd-journal
+
+mkdir -p /run/log/journal /var/log/journal
+chgrp systemd-journal /run/log/journal /var/log/journal

linux_os/guide/system/logging/journald/dir_owner_system_journal/bash/ubuntu.sh

@@ -1,19 +1,3 @@
 # platform = multi_platform_ubuntu
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
-
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
-
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
-
-systemd-tmpfiles --create
+{{{ bash_set_journal_tmpfiles(2750) }}}

linux_os/guide/system/logging/journald/dir_owner_system_journal/rule.yml

@@ -21,13 +21,14 @@ severity: medium
 
 fixtext: |
     Configure the system to set the appropriate ownership to the directories
-    used by the systemd journal. Add or modify the following lines in the
-    "/usr/lib/tmpfiles.d/systemd.conf" file:
+    used by the systemd journal.
+    Create the drop-in file "/etc/tmpfiles.d/zzz-systemd-stig.conf" with the
+    following content:
     <pre>
-    z /run/log/journal 2640 root systemd-journal - -
-    z /var/log/journal 2640 root systemd-journal - -
+    z /run/log/journal 0640 root systemd-journal - -
+    z /var/log/journal 0640 root systemd-journal - -
     </pre>
-    Restart the system for the changes to take effect.
+    Note: Restart the system for these settings to take effect.
 
 template:
     name: file_owner

linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/correct_owner.pass.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /run/log/journal /var/log/journal
+chown -R root /run/log/journal /var/log/journal

linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/incorrect_owner.fail.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+useradd testuser_123
+
+mkdir -p /run/log/journal /var/log/journal
+mkdir -p /run/log/journal/wrong_owner_dir
+chown -R testuser_123 /run/log/journal/wrong_owner_dir

linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/nested_subdir_owner.fail.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+id testuser_123 &>/dev/null || useradd testuser_123
+
+machine_id="$(cat /etc/machine-id)"
+mkdir -p "/run/log/journal/${machine_id}/nested/deeper"
+mkdir -p "/var/log/journal/${machine_id}/nested/deeper"
+
+chown testuser_123 "/run/log/journal/${machine_id}/nested/deeper"
+chown testuser_123 "/var/log/journal/${machine_id}/nested/deeper"

linux_os/guide/system/logging/journald/dir_owner_system_journal/tests/no_file.pass.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /run/log/journal /var/log/journal
+chown root /run/log/journal /var/log/journal

linux_os/guide/system/logging/journald/dir_permissions_system_journal/bash/ubuntu.sh

@@ -1,19 +1,3 @@
 # platform = multi_platform_ubuntu
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
-
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
-
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
-
-systemd-tmpfiles --create
+{{{ bash_set_journal_tmpfiles(2750) }}}

linux_os/guide/system/logging/journald/dir_permissions_system_journal/rule.yml

@@ -18,16 +18,21 @@ rationale: |-
 severity: medium
 
 fixtext: |
-    Configure the system to set the appropriate permissions to the files and directories
-    used by the systemd journal:
-    Add or modify the following lines in the "/etc/tmpfiles.d/systemd.conf" file:
+    Configure the system to set the appropriate permissions to the directories
+    used by the systemd journal.
+    Create a drop-in file, if it does not already exist with the following command:
+    <pre>
+    $ sudo vi /etc/tmpfiles.d/zzz-systemd-stig.conf
+    </pre>
+    Add or modify the following lines in the "/etc/tmpfiles.d/zzz-systemd-stig.conf" file:
     <pre>
     z /run/log/journal 2750 root systemd-journal - -
     Z /run/log/journal/%m ~2750 root systemd-journal - -
     z /var/log/journal 2750 root systemd-journal - -
     z /var/log/journal/%m 2750 root systemd-journal - -
+    z /var/log/journal/%m/system.journal 2750 root systemd-journal - -
     </pre>
-    Restart the system for the changes to take effect.
+    Note: Restart the system for these settings to take effect.
 
 template:
     name: file_permissions

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/correct_permissions.pass.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /run/log/journal /var/log/journal
+find /run/log/journal /var/log/journal -type d -exec chmod 2750 {} \;

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/lenient_permissions.fail.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /run/log/journal /var/log/journal
+mkdir -p /run/log/journal/loose_dir
+chmod 777 /run/log/journal/loose_dir

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/nested_subdir_permissions.fail.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+machine_id="$(cat /etc/machine-id)"
+
+mkdir -p "/run/log/journal/${machine_id}/nested/deeper"
+mkdir -p "/var/log/journal/${machine_id}/nested/deeper"
+
+chmod 2755 "/run/log/journal/${machine_id}/nested"
+chmod 2777 "/run/log/journal/${machine_id}/nested/deeper"
+chmod 2755 "/var/log/journal/${machine_id}/nested"
+chmod 2777 "/var/log/journal/${machine_id}/nested/deeper"

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/no_file.pass.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /run/log/journal /var/log/journal
+rm -rf /run/log/journal/* /var/log/journal/*
+chmod 2750 /run/log/journal /var/log/journal

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/stricter_permissions.pass.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+mkdir -p /run/log/journal /var/log/journal
+find /run/log/journal /var/log/journal -type d -exec chmod 0700 {} \;

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_early_filename_precedence.fail.sh

@@ -0,0 +1,22 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+# Precedence dimension: FILE NAME ordering.
+#
+# Configuration files are read from /etc/tmpfiles.d, /run/tmpfiles.d and
+# /usr/lib/tmpfiles.d and are sorted by file name regardless of the directory
+# they live in. Because z/Z entries adjust permissions of existing inodes, every
+# matching entry is applied and the one applied last wins. A drop-in that sorts
+# *before* the vendor systemd.conf is therefore overridden by it.
+#
+# Place a hardening drop-in under a name that sorts before "systemd.conf" so it
+# loses against the vendor entry, together with a loose drop-in that sorts after
+# it. The remediation writes "zzz-systemd-stig.conf", which sorts last and wins.
+mkdir -p /etc/tmpfiles.d
+cat > /etc/tmpfiles.d/00-journal-hardening.conf <<'EOF'
+z /run/log/journal 2750 root systemd-journal - -
+z /var/log/journal 2750 root systemd-journal - -
+EOF
+
+mkdir -p /run/log/journal /var/log/journal
+chmod 2755 /run/log/journal /var/log/journal

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_hardened_dropin.pass.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+# Precedence dimension: correctly ordered drop-in (positive case).
+#
+# A drop-in that sorts after the vendor systemd.conf and repeats the vendor line
+# types and paths wins, because for z/Z entries every matching entry is applied
+# and the entry applied last takes effect. Non-recursive "z" entries are applied
+# after recursive "Z" entries, which is why the plain "z" lines are required in
+# addition to the recursive ones.
+mkdir -p /etc/tmpfiles.d
+cat > /etc/tmpfiles.d/zzz-systemd-stig.conf <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+EOF
+
+mkdir -p /run/log/journal /var/log/journal
+chmod 2755 /run/log/journal /var/log/journal
+systemd-tmpfiles --create

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_late_filename_precedence.fail.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+# Precedence dimension: FILE NAME ordering, drop-in sorting AFTER the drop-in
+# written by the remediation.
+#
+# Because z/Z entries are applied to already existing inodes, systemd-tmpfiles
+# applies every matching entry and the entry applied last wins. A drop-in that
+# sorts after "zzz-systemd-stig.conf" would therefore be applied last and would
+# reset the journal directories back to a too permissive mode. The remediation
+# neutralizes conflicting journal entries in the other drop-ins.
+mkdir -p /etc/tmpfiles.d
+cat > /etc/tmpfiles.d/zzzz-late-override.conf <<'EOF'
+z /run/log/journal 2755 root systemd-journal - -
+z /var/log/journal 2755 root systemd-journal - -
+EOF
+
+mkdir -p /run/log/journal /var/log/journal
+chmod 2755 /run/log/journal /var/log/journal

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_line_type_precedence.fail.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+# Precedence dimension: LINE TYPE.
+#
+# systemd ships /usr/lib/tmpfiles.d/systemd.conf with a non-recursive
+# "z /run/log/journal 2755" entry. For z/Z lines systemd-tmpfiles applies every
+# matching entry instead of de-duplicating them, and non-recursive "z" lines are
+# applied after recursive "Z" lines. A drop-in that only carries recursive "Z"
+# lines is therefore overridden by the vendor "z" entry and the directories stay
+# at 2755. The remediation must emit matching "z" lines as well.
+#
+# Re-create the vendor situation and leave a drop-in that only uses "Z".
+mkdir -p /etc/tmpfiles.d
+cat > /etc/tmpfiles.d/zzz-systemd-stig.conf <<'EOF'
+Z /run/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+EOF
+
+mkdir -p /run/log/journal /var/log/journal
+chmod 2755 /run/log/journal /var/log/journal

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/tmpfiles_runtime_dropin_precedence.fail.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+# Precedence dimension: CONFIGURATION DIRECTORY.
+#
+# Configuration is read from /etc/tmpfiles.d, /run/tmpfiles.d and
+# /usr/lib/tmpfiles.d, and the files of all three directories are sorted
+# together by file name. A loose entry dropped into /run/tmpfiles.d under a name
+# that sorts last is therefore applied after the hardened entry.
+mkdir -p /run/tmpfiles.d
+cat > /run/tmpfiles.d/zzzzz-runtime-override.conf <<'EOF'
+z /run/log/journal 2777 root systemd-journal - -
+z /var/log/journal 2777 root systemd-journal - -
+EOF
+
+mkdir -p /run/log/journal /var/log/journal
+chmod 2777 /run/log/journal /var/log/journal

linux_os/guide/system/logging/journald/dir_permissions_system_journal/tests/vendor_conf_precedence.fail.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# platform = multi_platform_ubuntu
+
+# Precedence dimension: VENDOR configuration in /usr/lib/tmpfiles.d.
+#
+# systemd ships /usr/lib/tmpfiles.d/systemd.conf, which contains
+#   z /run/log/journal 2755 root systemd-journal - -
+#   z /var/log/journal 2755 root systemd-journal - -
+#   z /var/log/journal/%m 2755 root systemd-journal - -
+# so a stock system ends up with the too permissive mode 2755 as soon as
+# systemd-tmpfiles runs. The vendor file must not be edited, the hardened
+# entries have to be shipped in a drop-in that is applied after it.
+#
+# Reproduce the stock state and remove any hardening drop-in.
+rm -f /etc/tmpfiles.d/zzz-systemd-stig.conf
+
+mkdir -p /run/log/journal /var/log/journal
+find /run/log/journal /var/log/journal -type d -exec chmod 2755 {} \;

linux_os/guide/system/logging/journald/file_groupowner_system_journal/bash/ubuntu.sh

@@ -1,19 +1,3 @@
 # platform = multi_platform_ubuntu
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
-
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
-
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
-
-systemd-tmpfiles --create
+{{{ bash_set_journal_tmpfiles(2750) }}}