Align /var/log ownership rules with Ubuntu CIS

[mpurg]

Description:

Rules file_ownerships_var_log and file_groupownerships_var_log were fixed
to allow log files to be owned by all system accounts (accounts without valid login shell).

Rationale:

The change aligns the rules with:

• Ubuntu 24.04 CIS v1.0.0 rule 6.1.4.1
• Ubuntu 22.04 CIS v3.0.0 rule 6.1.3.1

[dodys]

lgtm, thanks!

[Mab879]

I only commented first two instances but normally in XML files use {{%. Please double check.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_systemd_journal_upload_server_tls' differs.
--- xccdf_org.ssgproject.content_rule_systemd_journal_upload_server_tls
+++ xccdf_org.ssgproject.content_rule_systemd_journal_upload_server_tls
@@ -28,19 +28,19 @@
     fi
 
     # find key in section and change value
-    if grep -qzosP "(?m)^[[:space:]]*\[Upload\]([^\n\[]*\n+)+?[[:space:]]*ServerKeyFile" "$f"; then
-        if ! grep -qzosP "(?m)^[[:space:]]*ServerKeyFile[[:space:]]*=[[:space:]]*$var_journal_upload_server_key_file" "$f"; then
+    if grep -qzosP "[[:space:]]*\[Upload\]([^\n\[]*\n+)+?[[:space:]]*ServerKeyFile" "$f"; then
+        if ! grep -qPz "ServerKeyFile=$var_journal_upload_server_key_file" "$f"; then
 
-            sed -i "/^[[:space:]]*ServerKeyFile/s/\([[:blank:]]*=[[:blank:]]*\).*/\1$var_journal_upload_server_key_file/" "$f"
+            sed -i "s/ServerKeyFile[^(\n)]*/ServerKeyFile=$var_journal_upload_server_key_file/" "$f"
 
         fi
 
         found=true
 
     # find section and add key = value to it
-    elif grep -qs "^[[:space:]]*\[Upload\]" "$f"; then
+    elif grep -qs "[[:space:]]*\[Upload\]" "$f"; then
 
-            sed -i "/^[[:space:]]*\[Upload\]/a ServerKeyFile=$var_journal_upload_server_key_file" "$f"
+            sed -i "/[[:space:]]*\[Upload\]/a ServerKeyFile=$var_journal_upload_server_key_file" "$f"
 
             found=true
     fi
@@ -63,19 +63,19 @@
     fi
 
     # find key in section and change value
-    if grep -qzosP "(?m)^[[:space:]]*\[Upload\]([^\n\[]*\n+)+?[[:space:]]*ServerCertificateFile" "$f"; then
-        if ! grep -qzosP "(?m)^[[:space:]]*ServerCertificateFile[[:space:]]*=[[:space:]]*$var_journal_upload_server_certificate_file" "$f"; then
+    if grep -qzosP "[[:space:]]*\[Upload\]([^\n\[]*\n+)+?[[:space:]]*ServerCertificateFile" "$f"; then
+        if ! grep -qPz "ServerCertificateFile=$var_journal_upload_server_certificate_file" "$f"; then
 
-            sed -i "/^[[:space:]]*ServerCertificateFile/s/\([[:blank:]]*=[[:blank:]]*\).*/\1$var_journal_upload_server_certificate_file/" "$f"
+            sed -i "s/ServerCertificateFile[^(\n)]*/ServerCertificateFile=$var_journal_upload_server_certificate_file/" "$f"
 
         fi
 
         found=true
 
     # find section and add key = value to it
-    elif grep -qs "^[[:space:]]*\[Upload\]" "$f"; then
+    elif grep -qs "[[:space:]]*\[Upload\]" "$f"; then
 
-            sed -i "/^[[:space:]]*\[Upload\]/a ServerCertificateFile=$var_journal_upload_server_certificate_file" "$f"
+            sed -i "/[[:space:]]*\[Upload\]/a ServerCertificateFile=$var_journal_upload_server_certificate_file" "$f"
 
             found=true
     fi
@@ -98,19 +98,19 @@
     fi
 
     # find key in section and change value
-    if grep -qzosP "(?m)^[[:space:]]*\[Upload\]([^\n\[]*\n+)+?[[:space:]]*TrustedCertificateFile" "$f"; then
-        if ! grep -qzosP "(?m)^[[:space:]]*TrustedCertificateFile[[:space:]]*=[[:space:]]*$var_journal_upload_server_trusted_certificate_file" "$f"; then
+    if grep -qzosP "[[:space:]]*\[Upload\]([^\n\[]*\n+)+?[[:space:]]*TrustedCertificateFile" "$f"; then
+        if ! grep -qPz "TrustedCertificateFile=$var_journal_upload_server_trusted_certificate_file" "$f"; then
 
-            sed -i "/^[[:space:]]*TrustedCertificateFile/s/\([[:blank:]]*=[[:blank:]]*\).*/\1$var_journal_upload_server_trusted_certificate_file/" "$f"
+            sed -i "s/TrustedCertificateFile[^(\n)]*/TrustedCertificateFile=$var_journal_upload_server_trusted_certificate_file/" "$f"
 
         fi
 
         found=true
 
     # find section and add key = value to it
-    elif grep -qs "^[[:space:]]*\[Upload\]" "$f"; then
+    elif grep -qs "[[:space:]]*\[Upload\]" "$f"; then
 
-            sed -i "/^[[:space:]]*\[Upload\]/a TrustedCertificateFile=$var_journal_upload_server_trusted_certificate_file" "$f"
+            sed -i "/[[:space:]]*\[Upload\]/a TrustedCertificateFile=$var_journal_upload_server_trusted_certificate_file" "$f"
 
             found=true
     fi

bash remediation for rule 'xccdf_org.ssgproject.content_rule_coredump_disable_backtraces' differs.
--- xccdf_org.ssgproject.content_rule_coredump_disable_backtraces
+++ xccdf_org.ssgproject.content_rule_coredump_disable_backtraces
@@ -10,19 +10,19 @@
     fi
 
     # find key in section and change value
-    if grep -qzosP "(?m)^[[:space:]]*\[Coredump\]([^\n\[]*\n+)+?[[:space:]]*ProcessSizeMax" "$f"; then
-        if ! grep -qzosP "(?m)^[[:space:]]*ProcessSizeMax[[:space:]]*=[[:space:]]*0" "$f"; then
+    if grep -qzosP "[[:space:]]*\[Coredump\]([^\n\[]*\n+)+?[[:space:]]*ProcessSizeMax" "$f"; then
+        if ! grep -qPz "ProcessSizeMax=0" "$f"; then
 
-            sed -i "/^[[:space:]]*ProcessSizeMax/s/\([[:blank:]]*=[[:blank:]]*\).*/\10/" "$f"
+            sed -i "s/ProcessSizeMax[^(\n)]*/ProcessSizeMax=0/" "$f"
 
         fi
 
         found=true
 
     # find section and add key = value to it
-    elif grep -qs "^[[:space:]]*\[Coredump\]" "$f"; then
+    elif grep -qs "[[:space:]]*\[Coredump\]" "$f"; then
 
-            sed -i "/^[[:space:]]*\[Coredump\]/a ProcessSizeMax=0" "$f"
+            sed -i "/[[:space:]]*\[Coredump\]/a ProcessSizeMax=0" "$f"
 
             found=true
     fi

bash remediation for rule 'xccdf_org.ssgproject.content_rule_coredump_disable_storage' differs.
--- xccdf_org.ssgproject.content_rule_coredump_disable_storage
+++ xccdf_org.ssgproject.content_rule_coredump_disable_storage
@@ -10,19 +10,19 @@
     fi
 
     # find key in section and change value
-    if grep -qzosP "(?m)^[[:space:]]*\[Coredump\]([^\n\[]*\n+)+?[[:space:]]*Storage" "$f"; then
-        if ! grep -qzosP "(?m)^[[:space:]]*Storage[[:space:]]*=[[:space:]]*none" "$f"; then
+    if grep -qzosP "[[:space:]]*\[Coredump\]([^\n\[]*\n+)+?[[:space:]]*Storage" "$f"; then
+        if ! grep -qPz "Storage=none" "$f"; then
 
-            sed -i "/^[[:space:]]*Storage/s/\([[:blank:]]*=[[:blank:]]*\).*/\1none/" "$f"
+            sed -i "s/Storage[^(\n)]*/Storage=none/" "$f"
 
         fi
 
         found=true
 
     # find section and add key = value to it
-    elif grep -qs "^[[:space:]]*\[Coredump\]" "$f"; then
+    elif grep -qs "[[:space:]]*\[Coredump\]" "$f"; then
 
-            sed -i "/^[[:space:]]*\[Coredump\]/a Storage=none" "$f"
+            sed -i "/[[:space:]]*\[Coredump\]/a Storage=none" "$f"
 
             found=true
     fi

[mpurg]

@Mab879 can you have a look?