Detections
Analytics

6.1.2.6 Ensure access to the rsyslog work directory is configured

Information

rsyslog's work directory, set by the global $WorkDirectory / global(workDirectory=...) directive and defaulting to /var/lib/rsyslog, stores disk-assisted queue spool files. These files can hold buffered log data written to disk when in-memory queues are exhausted or a forwarding action is retrying. The work directory should be owned by root, group-owned by root, and accessible only to root.

Spooled queue files under the rsyslog work directory can contain log records, potentially including sensitive event data, held on disk before delivery. If the work directory is readable or writable by non-privileged accounts, buffered log data could be disclosed, altered, or deleted before it reaches its destination. Restricting the work directory to root protects buffered log data at rest.

Solution

Run the following commands to set ownership to root:root and remove all group and other access from the work directory (substitute a non-default $WorkDirectory path if configured):

# chown root:root /var/lib/rsyslog
# chmod go-rwx /var/lib/rsyslog

Impact:

None. The recommended ownership and permissions match the rsyslog package default (0700 root:root), so applying this recommendation does not change default system behavior. If a non-default work directory is configured, the same ownership and mode should be applied to it.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: df421aca1cafabcd1a1d5d78d6952901b122596f2284a2c263211df107752ddc