Ubuntu Security Guide

Usg fix for CIS of logfiles permissions are not persistent

Bug #1965164 reported by Guilherme T Maeoka
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu Security Guide
Opinion
Undecided
David Fernandez Gonzalez

Bug Description

The audit of CIS 4.2.3 "Ensure permissions on all logfiles are configured" still fails after a usg fix of CIS level 1 workstation on Ubuntu 20.04 LTS. It looks like the permissions are not persistent after a reboot.

Adding "create 0640 root root" to the config files in /etc/logrotate.d/ didn't persist as well.

Adam Bell (arbell)
Changed in ubuntu-security-certifications:
status: New → In Progress
status: In Progress → Incomplete
status: Incomplete → In Progress
Revision history for this message
Adam Bell (arbell) wrote :

Hi Guilherme,

Thank you for reporting this!

I've been able to verify that this rule leaves permissions in /var/log/ as-is during hardening (which can be less-restrictive than 0640).

With the non-persistence on your system, does your system revert permissions if you manually `chmod` files in /var/log/ ?

Respectfully,
Adam

Revision history for this message
Guilherme T Maeoka (tummy-procedure) wrote (last edit ):

Hi Adam

> does your system revert permissions if you manually `chmod` files in /var/log/ ?
Yes, it does. But I think it had to with the configurations in "/etc/logrotate.conf" and "/etc/logrotate.d/": After I changed the config to "create 0640", the permissions were not reverted anymore.

But usg didn't fix the rule "4.4 Ensure logrotate assigns appropriate permissions (Automated)", so I had to change the configs manually.

Thanks.

Eduardo Barretto (ebarretto)
affects: ubuntu-security-certifications → usg
David Fernandez Gonzalez (litios)
Changed in usg:
assignee: nobody → David Fernandez Gonzalez (litios)
Revision history for this message
David Fernandez Gonzalez (litios) wrote :

A fix for this issue has been proposed. Thanks for the report!

David Fernandez Gonzalez (litios)
Changed in usg:
status: In Progress → Fix Committed
Revision history for this message
Eduardo Barretto (ebarretto) wrote :

Not sure why but launchpad is not letting me move to Won't fix.
Since this issue is only for CIS 1.0.0 and there's newer versions of it, I believe we won't be landing this anytime soon.

Changed in usg:
status: Fix Committed → In Progress
status: In Progress → Invalid
status: Invalid → Opinion
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.