{"description": "Verify the /run/log/journal and /var/log/journal files are owned by\n\"root\" by using the following command:\n<pre>\n$ sudo find /run/log/journal /var/log/journal  -type f -exec stat -c \"%n %U\" {} \\;\n</pre>\nIf any output returned is not owned by \"root\", this is a finding.", "rationale": "Only authorized personnel should be aware of errors and the details of the errors.\nError messages are an indicator of an organization's operational state or can\nidentify the operating system or platform. Additionally, personally identifiable\ninformation (PII) and operational information must not be revealed through error\nmessages to unauthorized personnel or their designated representatives.", "severity": "medium", "references": {"srg": ["SRG-APP-000118-CTR-000240"], "stigid": ["UBTU-22-232090"], "stigref": ["SV-260503r958566_rule"]}, "control_references": {"stigid": ["UBTU-22-232090"]}, "components": [], "identifiers": {}, "ocil_clause": "/var/log/journal/.*/system.journal does not have an owner of root", "ocil": "To check the ownership of <code>/var/log/journal/.*/system.journal</code>,\nrun the command:\n<pre>$ ls -lL /var/log/journal/.*/system.journal</pre>\nIf properly configured, the output should indicate the following owner:\n<code>root</code>", "oval_external_content": null, "fixtext": "Configure the system to set the appropriate ownership to the files\nused by the systemd journal:\nAdd or modify the following lines in the \"/etc/tmpfiles.d/systemd.conf\" file:\n<pre>\nz /var/log/journal/%m/system.journal 0640 root systemd-journal - -\n</pre>\nRestart the system for the changes to take effect.\n", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": ["system_with_kernel"], "cpe_platform_names": [], "inherited_cpe_platform_names": ["system_with_kernel"], "bash_conditional": null, "fixes": {}, "title": "Verify Owner on the system journal", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/logging/journald/file_owner_system_journal/rule.yml", "template": {"name": "file_owner", "vars": {"filepath": ["/run/log/journal/", "/var/log/journal/"], "recursive": "true", "file_regex": "^.*$", "uid_or_name": "0"}, "backends": {}}}