# Ensure journald log file access is configured

Necessity: The systemd journal files contain detailed logging information about system operations, user activities, and potential errors or security events. Unrestricted access to these logs could expose sensitive information, helping an attacker understand system behavior, identify vulnerabilities, or cover their tracks. Properly configured permissions restrict access to only authorized users and processes, such as root and the 'systemd-journal' group, upholding the principle of least privilege and protecting critical audit data.

Auditing and Remediation: The audit script verifies the security of the journald logs by checking the octal file permission mode of the primary log directory, '/var/log/journal'. The remediation script uses 'chmod' to set the directory permissions to the specified secure state and 'chown' to enforce correct ownership ('root:systemd-journal'). It also ensures the set-group-ID (SGID) bit is set so that files created in the directory inherit the correct group ownership.

Recommended State Rationale:
- Basic: ['2755'] - This is a common standard (CIS Level 1) that secures the log directory while allowing all system users read and execute permissions, which may be needed for certain diagnostic tools. The SGID bit (the '2') ensures proper group ownership is maintained for new log files.
- Moderate: ['2750'] - This state improves security by removing read and execute permissions for 'others'. Access is restricted to just the root user and members of the 'systemd-journal' group, which is appropriate for most production environments.
- Strict: ['2700'] - This is the most restrictive state, removing all permissions for both the group and others. Only the root user has access to the journal directory. This configuration is suitable for high-security systems where access to raw log data must be tightly controlled and managed exclusively by the superuser.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['2755']` |
| **Moderate** | `['2750']` |
| **Strict** | `['2700']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that determines the file permissions for the '/var/log/journal' directory. The script must output only the octal permission code (e.g., '2755'). If the directory does not exist, the script should output 'not_found'.

## Remediation Script Working

Bash script that accepts a single positional argument representing an octal permission code. The script must apply this permission code to the '/var/log/journal' directory, ensure its ownership is 'root:systemd-journal', and apply 'g+s' to enforce group inheritance. The script must return 'true' on success and 'false' on failure.

