{"description": "Verify the /run/log/journal and /var/log/journal directories are group-owned by\n\"systemd-journal\" by using the following command:\n<pre>\n$ sudo find /run/log/journal /var/log/journal  -type d -exec stat -c \"%n %G\" {} \\;\n</pre>\nIf any output returned is not owned by \"systemd-journal\", this is a finding.", "rationale": "Only authorized personnel should be aware of errors and the details of the errors.\nError messages are an indicator of an organization's operational state or can identify\nthe operating system or platform. Additionally, personally identifiable information\n(PII) and operational information must not be revealed through error messages to\nunauthorized personnel or their designated representatives.", "severity": "medium", "references": {"stigid": ["UBTU-22-232085"], "stigref": ["SV-260502r958566_rule"]}, "control_references": {"stigid": ["UBTU-22-232085"]}, "components": [], "identifiers": {}, "ocil_clause": null, "ocil": null, "oval_external_content": null, "fixtext": "Configure the system to set the appropriate ownership to the directories\nused by the systemd journal. Add or modify the following lines in the\n\"/usr/lib/tmpfiles.d/systemd.conf\" file:\n<pre>\nz /run/log/journal 2640 root systemd-journal - -\nz /var/log/journal 2640 root systemd-journal - -\n</pre>\nRestart the system for the changes to take effect.\n", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": ["system_with_kernel"], "cpe_platform_names": [], "inherited_cpe_platform_names": ["system_with_kernel"], "bash_conditional": null, "fixes": {}, "title": "Verify group-owner of system journal directories", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/logging/journald/dir_groupowner_system_journal/rule.yml", "template": {"name": "file_groupowner", "vars": {"filepath": ["/run/log/journal/", "/var/log/journal/"], "recursive": "true", "gid_or_name": "systemd-journal"}, "backends": {}}}