[Ubuntu] Fix tmpfiles.d rules by alanmcanonical · Pull Request #15048 · ComplianceAsCode/content

alanmcanonical · 2026-08-25T14:17:08Z

Description:

Change tmpfiles.d conf path per stig noble v1r6

openshift-ci · 2026-08-25T14:17:21Z

Hi @alanmcanonical. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

github-actions · 2026-08-25T14:21:52Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_groupowner_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_dir_groupowner_system_journal
+++ xccdf_org.ssgproject.content_rule_dir_groupowner_system_journal
@@ -1,21 +1,32 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^[[:space:]]*[zZ][+]*[[:space:]]+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^([[:space:]]*[zZ][+]*[[:space:]]+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_owner_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_dir_owner_system_journal
+++ xccdf_org.ssgproject.content_rule_dir_owner_system_journal
@@ -1,21 +1,32 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^[[:space:]]*[zZ][+]*[[:space:]]+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^([[:space:]]*[zZ][+]*[[:space:]]+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
 

bash remediation for rule 'xccdf_org.ssgproject.content_rule_dir_permissions_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_dir_permissions_system_journal
+++ xccdf_org.ssgproject.content_rule_dir_permissions_system_journal
@@ -1,21 +1,32 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^[[:space:]]*[zZ][+]*[[:space:]]+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^([[:space:]]*[zZ][+]*[[:space:]]+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
 

OVAL for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_system_journal' differs.
--- oval:ssg-file_groupowner_system_journal:def:1
+++ oval:ssg-file_groupowner_system_journal:def:1
@@ -1,3 +1,2 @@
 criteria AND
 criterion oval:ssg-test_file_groupowner_system_journal_0:tst:1
-criterion oval:ssg-test_file_groupowner_system_journal_1:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_system_journal
+++ xccdf_org.ssgproject.content_rule_file_groupowner_system_journal
@@ -1,21 +1,32 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^[[:space:]]*[zZ][+]*[[:space:]]+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^([[:space:]]*[zZ][+]*[[:space:]]+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_system_journal
+++ xccdf_org.ssgproject.content_rule_file_groupowner_system_journal
@@ -43,13 +43,10 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Find /run/log/journal/ file(s) matching ^.*$ recursively
-  ansible.builtin.command: find -P /run/log/journal/  -type f  ! -group systemd-journal
-    -regextype posix-extended -regex "^.*$"
-  register: files_found
-  changed_when: false
-  failed_when: false
-  check_mode: false
+- name: Test for existence ^/var/log/journal/.*/system.journal$
+  ansible.builtin.stat:
+    path: ^/var/log/journal/.*/system.journal$
+  register: file_exists
   when: '"linux-base" in ansible_facts.packages'
   tags:
   - DISA-STIG-UBTU-22-232095
@@ -60,15 +57,14 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Ensure group owner on /run/log/journal/ file(s) matching ^.*$
+- name: Ensure group owner on ^/var/log/journal/.*/system.journal$
   ansible.builtin.file:
-    path: '{{ item }}'
+    path: ^/var/log/journal/.*/system.journal$
     follow: false
     group: '{{ file_groupowner_system_journal_newgroup }}'
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
-  when: '"linux-base" in ansible_facts.packages'
+  when:
+  - '"linux-base" in ansible_facts.packages'
+  - file_exists.stat is defined and file_exists.stat.exists
   tags:
   - DISA-STIG-UBTU-22-232095
   - configure_strategy
@@ -77,38 +73,3 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
-
-- name: Find /var/log/journal/ file(s) matching ^.*$ recursively
-  ansible.builtin.command: find -P /var/log/journal/  -type f  ! -group systemd-journal
-    -regextype posix-extended -regex "^.*$"
-  register: files_found
-  changed_when: false
-  failed_when: false
-  check_mode: false
-  when: '"linux-base" in ansible_facts.packages'
-  tags:
-  - DISA-STIG-UBTU-22-232095
-  - configure_strategy
-  - file_groupowner_system_journal
-  - low_complexity
-  - low_disruption
-  - medium_severity
-  - no_reboot_needed
-
-- name: Ensure group owner on /var/log/journal/ file(s) matching ^.*$
-  ansible.builtin.file:
-    path: '{{ item }}'
-    follow: false
-    group: '{{ file_groupowner_system_journal_newgroup }}'
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
-  when: '"linux-base" in ansible_facts.packages'
-  tags:
-  - DISA-STIG-UBTU-22-232095
-  - configure_strategy
-  - file_groupowner_system_journal
-  - low_complexity
-  - low_disruption
-  - medium_severity
-  - no_reboot_needed

OVAL for rule 'xccdf_org.ssgproject.content_rule_file_owner_system_journal' differs.
--- oval:ssg-file_owner_system_journal:def:1
+++ oval:ssg-file_owner_system_journal:def:1
@@ -1,3 +1,2 @@
 criteria AND
 criterion oval:ssg-test_file_owner_system_journal_0:tst:1
-criterion oval:ssg-test_file_owner_system_journal_1:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_system_journal
+++ xccdf_org.ssgproject.content_rule_file_owner_system_journal
@@ -1,21 +1,32 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^[[:space:]]*[zZ][+]*[[:space:]]+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^([[:space:]]*[zZ][+]*[[:space:]]+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_system_journal
+++ xccdf_org.ssgproject.content_rule_file_owner_system_journal
@@ -23,13 +23,10 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Find /run/log/journal/ file(s) matching ^.*$ recursively
-  ansible.builtin.command: find -P /run/log/journal/  -type f  ! -user 0 -regextype
-    posix-extended -regex "^.*$"
-  register: files_found
-  changed_when: false
-  failed_when: false
-  check_mode: false
+- name: Test for existence ^/var/log/journal/.*/system.journal$
+  ansible.builtin.stat:
+    path: ^/var/log/journal/.*/system.journal$
+  register: file_exists
   when: '"linux-base" in ansible_facts.packages'
   tags:
   - DISA-STIG-UBTU-22-232090
@@ -40,15 +37,14 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Ensure owner on /run/log/journal/ file(s) matching ^.*$
+- name: Ensure owner on ^/var/log/journal/.*/system.journal$
   ansible.builtin.file:
-    path: '{{ item }}'
+    path: ^/var/log/journal/.*/system.journal$
     follow: false
     owner: '{{ file_owner_system_journal_newown }}'
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
-  when: '"linux-base" in ansible_facts.packages'
+  when:
+  - '"linux-base" in ansible_facts.packages'
+  - file_exists.stat is defined and file_exists.stat.exists
   tags:
   - DISA-STIG-UBTU-22-232090
   - configure_strategy
@@ -57,38 +53,3 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
-
-- name: Find /var/log/journal/ file(s) matching ^.*$ recursively
-  ansible.builtin.command: find -P /var/log/journal/  -type f  ! -user 0 -regextype
-    posix-extended -regex "^.*$"
-  register: files_found
-  changed_when: false
-  failed_when: false
-  check_mode: false
-  when: '"linux-base" in ansible_facts.packages'
-  tags:
-  - DISA-STIG-UBTU-22-232090
-  - configure_strategy
-  - file_owner_system_journal
-  - low_complexity
-  - low_disruption
-  - medium_severity
-  - no_reboot_needed
-
-- name: Ensure owner on /var/log/journal/ file(s) matching ^.*$
-  ansible.builtin.file:
-    path: '{{ item }}'
-    follow: false
-    owner: '{{ file_owner_system_journal_newown }}'
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
-  when: '"linux-base" in ansible_facts.packages'
-  tags:
-  - DISA-STIG-UBTU-22-232090
-  - configure_strategy
-  - file_owner_system_journal
-  - low_complexity
-  - low_disruption
-  - medium_severity
-  - no_reboot_needed

OVAL for rule 'xccdf_org.ssgproject.content_rule_file_permissions_system_journal' differs.
--- oval:ssg-file_permissions_system_journal:def:1
+++ oval:ssg-file_permissions_system_journal:def:1
@@ -1,3 +1,2 @@
 criteria AND
 criterion oval:ssg-test_file_permissions_system_journal_0:tst:1
-criterion oval:ssg-test_file_permissions_system_journal_1:tst:1

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_system_journal
+++ xccdf_org.ssgproject.content_rule_file_permissions_system_journal
@@ -1,21 +1,32 @@
 # Remediation is applicable only in certain platforms
 if dpkg-query --show --showformat='${db:Status-Status}' 'linux-base' 2>/dev/null | grep -q '^installed$'; then
 
-TMPFILES_CONF="/usr/lib/tmpfiles.d/systemd.conf"
+TMPFILES_CONF="/etc/tmpfiles.d/zzz-systemd-stig.conf"
 
-if ! grep -q 'Z /var/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/var\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/var\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
+mkdir -p /etc/tmpfiles.d
+touch "$TMPFILES_CONF"
+
+# Drop any previously written journal entries so stale or conflicting settings
+# in this file cannot be applied after the hardened ones.
+sed -i --follow-symlinks -E '/^[[:space:]]*[zZ][+]*[[:space:]]+\/(run|var)\/log\/journal/d' "$TMPFILES_CONF"
+
+# A drop-in whose name sorts after this file would be applied last and would
+# undo the hardening. Comment out journal entries in the other administrator
+# drop-ins so the hardened entries below are the effective ones.
+for conf in /etc/tmpfiles.d/*.conf /run/tmpfiles.d/*.conf; do
+    if [ -f "$conf" ] && [ "$conf" != "$TMPFILES_CONF" ]; then
+        sed -i --follow-symlinks -E 's,^([[:space:]]*[zZ][+]*[[:space:]]+/(run|var)/log/journal.*),# \1,' "$conf"
     fi
-    echo "Z /var/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+done
 
-if ! grep -q 'Z /run/log/journal ~2750 root systemd-journal - -' "$TMPFILES_CONF"; then
-    if grep -qP "^[zZ][+]*\s+\/run\/log\/journal" "$TMPFILES_CONF"; then
-        sed -i --follow-symlinks "s/\(^[zZ][+]*\)\(\s\+\/run\/log\/journal.*\)/# \1\2/" "$TMPFILES_CONF"
-    fi
-    echo "Z /run/log/journal ~2750 root systemd-journal - -" >>"$TMPFILES_CONF"
-fi
+cat >>"$TMPFILES_CONF" <<'EOF'
+z /run/log/journal ~2750 root systemd-journal - -
+Z /run/log/journal ~2750 root systemd-journal - -
+z /run/log/journal/%m ~2750 root systemd-journal - -
+z /var/log/journal ~2750 root systemd-journal - -
+Z /var/log/journal ~2750 root systemd-journal - -
+z /var/log/journal/%m ~2750 root systemd-journal - -
+EOF
 
 systemd-tmpfiles --create
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_system_journal' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_system_journal
+++ xccdf_org.ssgproject.content_rule_file_permissions_system_journal
@@ -10,13 +10,10 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Find /run/log/journal/ file(s) recursively
-  ansible.builtin.command: find -P /run/log/journal/  -perm /u+xs,g+xws,o+xwrt  -type
-    f -regextype posix-extended -regex "^.*$"
-  register: files_found
-  changed_when: false
-  failed_when: false
-  check_mode: false
+- name: Test for existence ^/var/log/journal/.*/system.journal$
+  ansible.builtin.stat:
+    path: ^/var/log/journal/.*/system.journal$
+  register: file_exists
   when: '"linux-base" in ansible_facts.packages'
   tags:
   - DISA-STIG-UBTU-22-232027
@@ -27,14 +24,13 @@
   - medium_severity
   - no_reboot_needed
 
-- name: Set permissions for /run/log/journal/ file(s)
+- name: Ensure permission u-xs,g-xws,o-xwrt on ^/var/log/journal/.*/system.journal$
   ansible.builtin.file:
-    path: '{{ item }}'
+    path: ^/var/log/journal/.*/system.journal$
     mode: u-xs,g-xws,o-xwrt
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
-  when: '"linux-base" in ansible_facts.packages'
+  when:
+  - '"linux-base" in ansible_facts.packages'
+  - file_exists.stat is defined and file_exists.stat.exists
   tags:
   - DISA-STIG-UBTU-22-232027
   - configure_strategy
@@ -43,37 +39,3 @@
   - low_disruption
   - medium_severity
   - no_reboot_needed
-
-- name: Find /var/log/journal/ file(s) recursively
-  ansible.builtin.command: find -P /var/log/journal/  -perm /u+xs,g+xws,o+xwrt  -type
-    f -regextype posix-extended -regex "^.*$"
-  register: files_found
-  changed_when: false
-  failed_when: false
-  check_mode: false
-  when: '"linux-base" in ansible_facts.packages'
-  tags:
-  - DISA-STIG-UBTU-22-232027
-  - configure_strategy
-  - file_permissions_system_journal
-  - low_complexity
-  - low_disruption
-  - medium_severity
-  - no_reboot_needed
-
-- name: Set permissions for /var/log/journal/ file(s)
-  ansible.builtin.file:
-    path: '{{ item }}'
-    mode: u-xs,g-xws,o-xwrt
-    state: file
-  with_items:
-  - '{{ files_found.stdout_lines }}'
-  when: '"linux-base" in ansible_facts.packages'
-  tags:
-  - DISA-STIG-UBTU-22-232027
-  - configure_strategy
-  - file_permissions_system_journal
-  - low_complexity
-  - low_disruption
-  - medium_severity
-  - no_reboot_needed

Create the macro to write the journal drop-in configurations in /etc/tmpfiles.d Signed-off-by: Alan Moore <alan.moore@canonical.com>

Signed-off-by: Alan Moore <alan.moore@canonical.com>

alanmcanonical · 2026-08-31T16:05:57Z

test result:

python3 tests/automatus.py rule --libvirt qemu:///system sec-noble-amd64 --datastream build/ssg-ubuntu2404-ds.xml --remediate-using bash --profile dir_permissions_system_journal dir_permissions_system_journal --profile stig
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/alan.moore@canonical.com/dev/cac/content/logs/rule-custom-2026-08-31-1703/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_dir_permissions_system_journal
INFO - Script stricter_permisions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script vendor_conf_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_runtime_dropin_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script stricter_permissions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script correct_permissions.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script no_file.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_late_filename_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_line_type_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_early_filename_precedence.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script nested_subdir_permissions.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script lenient_permissions.fail.sh using profile xccdf_org.ssgproject.content_profile_stig OK
INFO - Script tmpfiles_hardened_dropin.pass.sh using profile xccdf_org.ssgproject.content_profile_stig OK

openshift-ci Bot added the needs-ok-to-test Used by openshift-ci bot. label Aug 25, 2026

alanmcanonical added 2 commits August 31, 2026 08:45

Change tmpfiles.d conf path per stig noble v1r6

f914570

Create the macro to write the journal drop-in configurations in /etc/tmpfiles.d Signed-off-by: Alan Moore <alan.moore@canonical.com>

Add tests

309c873

Signed-off-by: Alan Moore <alan.moore@canonical.com>

alanmcanonical force-pushed the UBTU-24-700080 branch from c130f74 to 309c873 Compare August 31, 2026 14:14

alanmcanonical requested review from Mab879, jan-cerny, matusmarhefka and vojtapolasek as code owners August 31, 2026 14:14

Fix yamllint errors

f73bdc7

alanmcanonical changed the title ~~[Ubuntu] Fix UBTU-24-700080 UBTU-24-700090~~ [Ubuntu] Fix tmpfiles.d rules Aug 31, 2026

Remove unused templates

5ad9fb3

Signed-off-by: Alan Moore <alan.moore@canonical.com>

Navigation Menu

Uh oh!

[Ubuntu] Fix tmpfiles.d rules - #15048

[Ubuntu] Fix tmpfiles.d rules#15048
alanmcanonical wants to merge 4 commits into
ComplianceAsCode:masterfrom
alanmcanonical:UBTU-24-700080

alanmcanonical commented Aug 25, 2026

Uh oh!

openshift-ci Bot commented Aug 25, 2026

Uh oh!

github-actions Bot commented Aug 25, 2026 •

edited

Loading

Uh oh!

alanmcanonical commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

alanmcanonical commented Aug 25, 2026

Description:

Uh oh!

openshift-ci Bot commented Aug 25, 2026

Uh oh!

github-actions Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alanmcanonical commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Aug 25, 2026 •

edited

Loading