From efdc9a6a936ea679ee007b6284622c76aecc2304 Mon Sep 17 00:00:00 2001
From: Miha Purg <miha.purg@canonical.com>
Date: Fri, 12 Apr 2024 17:10:17 +0200
Subject: [PATCH] Add rule file_groupowner_journalctl

- New rule for auditing groupownership of journalctl command
- Satisfies STIG requirement UBTU-22-232105
- Based on file_owner_system_journal
---
 components/systemd.yml                        |  1 +
 .../file_groupowner_journalctl/rule.yml       | 36 +++++++++++++++++++
 products/ubuntu2204/profiles/stig.profile     |  3 +-
 3 files changed, 38 insertions(+), 2 deletions(-)
 create mode 100644 linux_os/guide/system/logging/journald/file_groupowner_journalctl/rule.yml

diff --git a/components/systemd.yml b/components/systemd.yml
index 8e60b65dbf4..5e8b75896a4 100644
--- a/components/systemd.yml
+++ b/components/systemd.yml
@@ -10,6 +10,7 @@ rules:
 - coredump_disable_storage
 - disable_ctrlaltdel_burstaction
 - file_groupowner_etc_crypttab
+- file_groupowner_journalctl
 - file_groupowner_system_journal
 - file_owner_etc_crypttab
 - file_owner_system_journal
diff --git a/linux_os/guide/system/logging/journald/file_groupowner_journalctl/rule.yml b/linux_os/guide/system/logging/journald/file_groupowner_journalctl/rule.yml
new file mode 100644
index 00000000000..eced8d45ea2
--- /dev/null
+++ b/linux_os/guide/system/logging/journald/file_groupowner_journalctl/rule.yml
@@ -0,0 +1,36 @@
+documentation_complete: true
+
+title: 'Verify Groupowner on the journalctl command'
+
+description: |-
+    Verify that the "journalctl" command is group-owned by "root" by
+    using the following command:
+    <pre>
+    $ sudo find /usr/bin/journalctl -exec stat -c "%n %G" {} \;
+    </pre>
+    If any output returned is not owned by "root", this is a finding.
+
+rationale: |-
+    Only authorized personnel should be aware of errors and the details of the errors.
+    Error messages are an indicator of an organization's operational state or can
+    identify the operating system or platform. Additionally, personally identifiable
+    information (PII) and operational information must not be revealed through error
+    messages to unauthorized personnel or their designated representatives.
+
+references:
+    disa: CCI-001314
+    stigid@ubuntu2204: UBTU-22-232105
+
+severity: medium
+
+fixtext: |
+    Configure "journalctl" to be owned by "root":
+    <pre>
+    $ sudo chown :root /usr/bin/journalctl
+    </pre>
+
+template:
+    name: file_groupowner
+    vars:
+        filepath: /usr/bin/journalctl
+        gid_or_name: '0'
diff --git a/products/ubuntu2204/profiles/stig.profile b/products/ubuntu2204/profiles/stig.profile
index 5fe21f5c71f..f989e493776 100644
--- a/products/ubuntu2204/profiles/stig.profile
+++ b/products/ubuntu2204/profiles/stig.profile
@@ -660,9 +660,8 @@ selections:
     # Similar to file_ownership_var_log_audit
     # UBTU-22-232100 The Ubuntu operating system must be configured so that the "journalctl" command is owned by "root"
 
-    ### TODO (rule needed)
-    # Similar to file_group_ownership_var_log_audit
     # UBTU-22-232105 The Ubuntu operating system must be configured so that the "journalctl" command is group-owned by "root"
+    - file_groupowner_journalctl
 
     ### TODO (rule needed)
     # Similar to file_permissions_var_log_audit