os_hardening is setting wrong ownership for /var/log on Ubuntu

[stdtom]

Description

os_hardening is setting group=root for /var/log (and every other mount point). This is hard-coded in

ansible-collection-hardening/roles/os_hardening/tasks/minimize_access.yml

Lines 204 to 209 in c1cd6c5

	- name: Harden permissions for /var/log directory
	file:
	dest: /var/log
	owner: 'root'
	group: 'root'
	mode: '{{ os_mnt_var_log_dir_mode }}'

for all OSes.

However, in Ubuntu rsyslog is running as user syslogby default and/var/loghasgroup=syslog` and permission 775 by default.

So with the current implementation os_hardening will prevent rsyslog from creating new logfiles e.g. after installing Postifx or any other MTA.

Reproduction steps

1. Create a new Ubuntu server (22.04)
2. Apply role `devsec.hardening.os_hardening`
3. Execute `ls -la /var/log`

Current Behavior

root@test:/var/log# ls -la /var/log
total 1108
drwxr-xr-x   9 root      root              4096 Jan  2 18:37 .

Expected Behavior

root@test:/var/log# ls -la /var/log
total 1108
drwxrwxr-x   9 root      syslog            4096 Jan  2 19:15 .

OS / Environment

Ubuntu 22.04

Ansible Version

2.13

Collection Version

8.4.0

Additional information

No response