Permissions on /var/log Revert to 0700 on Every Boot
Introduction
This article covers an issue where /var/log is more restrictive than the shipped default and reverts on each boot. One potential cause is the audit daemon.
Problem
An administrator expects to find /var/log at 0755, which is the shipped default, but finds it at 0700 instead. Applications or log collectors that read files under /var/log as a non-root user stop working, because a mode of 0700 prevents any non-root account from traversing the directory. Correcting the mode by hand does not survive the next reboot.
Symptoms
The directory mode is more restrictive than expected:
stat -c '%a %U:%G %n' /var/log
700 root:root /var/log
The boot journal shows the audit daemon starting immediately after systemd-tmpfiles has set the directory to 0755:
journalctl -b | grep -E 'Create Volatile Files|auditd.*Init complete'
Starting Create Volatile Files and Directories...
Finished Create Volatile Files and Directories.
auditd[1234]: Init complete, auditd 3.1.5 listening for events (startup state enable)
Resolution
Check where the audit daemon writes its log:
grep -E '^log_file|^log_group' /etc/audit/auditd.conf
A system exhibiting this issue has log_file pointing directly into /var/log rather than at the default of /var/log/audit/audit.log:
log_file = /var/log/auditd.log
log_group = root
The audit daemon restricts the directory that holds its log file, so a log file placed directly in /var/log causes the daemon to restrict /var/log itself. With log_group set to root, that mode is 0700.
Edit /etc/audit/auditd.conf and restore the default location:
log_file = /var/log/audit/audit.log
⚠️ WARNING Restarting the audit daemon interrupts audit logging briefly, and the log path changes. Schedule a maintenance window, and update any log shipping or monitoring that reads the old path first.
Restart the daemon. auditd.service sets RefuseManualStop=yes, so systemctl restart auditd is refused and the service wrapper is needed instead:
service auditd restart
The daemon no longer touches /var/log, but it does not raise the mode back either, so restore it once by hand. A reboot does the same by way of systemd-tmpfiles:
chmod 0755 /var/log
Confirm the result:
stat -c '%a %U:%G %n' /var/log /var/log/audit
755 root:root /var/log
700 root:root /var/log/audit
/var/log now holds at 0755 across daemon restarts and reboots, and the daemon restricts /var/log/audit, which is where that restriction belongs.