# Ensure journald log file access is configured

The systemd journal provides a centralized logging solution. Restricting access to its log files is critical to protect sensitive operational data and prevent unauthorized users from viewing or tampering with audit records. Misconfiguration could expose system vulnerabilities, user actions, or error messages that an attacker could leverage. It could also allow an attacker to cover their tracks by modifying or deleting log entries, severely hindering forensic analysis following a security incident. The audit script verifies the octal permission mode of the `/var/log/journal` directory, which is the primary storage location for persistent logs. The remediation script corrects the permissions and ownership using standard `chmod` and `chown` commands to enforce the desired access control policy. The 'Basic' state of '2755' is a secure default, ensuring the 'setgid' bit is enabled so that new log files inherit the correct group ownership (`systemd-journal`), while allowing read/execute access for all users. The 'Moderate' and 'Strict' state of '2750' enhances this by removing all permissions for 'others', adhering to the principle of least privilege. This prevents any user not in the `root` or `systemd-journal` group from accessing the directory, which is the recommended configuration for most production systems.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['2755']` |
| **Moderate** | `['2750']` |
| **Strict** | `['2750']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the file permissions for the directory `/var/log/journal`. The script should use `stat -c "%a" /var/log/journal` to retrieve the octal permission mode. The output must be only the numeric value (e.g., '2755'), with no extra text or formatting.

## Remediation Script Working

Bash script that accepts a desired permission mode as a single, positional command-line argument (e.g., './remediate.sh 2750'). The script must use `chmod` to apply the provided mode to the `/var/log/journal` directory. It should also recursively set ownership of the directory to `root:systemd-journal` and set the permissions of all files within to `640`. The script must output `true` on success and `false` on failure.

