documentation_complete: true

title: 'Ensure rsyslog Default File Permissions Configured'

description: |-
    rsyslog will create logfiles that do not already exist on the system.
    This settings controls what permissions will be applied to these newly
    created files.

rationale: |-
    It is important to ensure that log files have the correct permissions
    to ensure that sensitive data is archived and protected.

severity: medium

identifiers:
    cce@rhel8: CCE-88321-5
    cce@rhel9: CCE-88322-3
    cce@sle15: CCE-92599-0

ocil_clause: '$FileCreateMode is not set or is more permissive than 0640'

ocil: |-
    Run the following command:
    <pre># grep ^\$FileCreateMode /etc/rsyslog.conf /etc/rsyslog.d/*.conf</pre>
    Verify the output matches:
    <pre>$FileCreateMode 0640</pre>
    Should a site policy dictate less restrictive permissions, ensure to follow
    said policy.

fixtext: |-
    Edit either `/etc/rsyslog.conf` or a dedicated .conf file in `/etc/rsyslog.d/`
    and set $FileCreateMode to 0640 or more restrictive:
    $FileCreateMode 0640
    Restart the service:
    # systemctl restart rsyslog

{{% if product in ['ubuntu2404'] %}}
platform: not service_disabled[rsyslog]
{{% endif %}}
