Check: APPL-14-000031
Apple macOS 14 (Sonoma) STIG:
APPL-14-000031
(in versions v1 r2 through v1 r1)
Title
The macOS system must configure audit log folders to not contain access control lists. (Cat II impact)
Discussion
The audit log folder must not contain access control lists (ACLs). Audit logs contain sensitive data about the system and users. This rule ensures that the audit service is configured to create log folders that are readable and writable only by system administrators in order to prevent normal users from reading audit logs. Satisfies: SRG-OS-000057-GPOS-00027,SRG-OS-000058-GPOS-00028,SRG-OS-000059-GPOS-00029,SRG-OS-000256-GPOS-00097,SRG-OS-000257-GPOS-00098,SRG-OS-000258-GPOS-00099
Check Content
Verify the macOS system is configured without ACLs applied to log folders with the following command: /bin/ls -lde /var/audit | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" If the result is not "0", this is a finding.
Fix Text
Configure the macOS system without ACLs applied to log folders with the following command: /bin/chmod -N /var/audit
Additional Identifiers
Rule ID: SV-259433r940921_rule
Vulnerability ID: V-259433
Group Title: SRG-OS-000057-GPOS-00027
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000162 |
The information system protects audit information from unauthorized access. |
| CCI-000163 |
The information system protects audit information from unauthorized modification. |
| CCI-000164 |
The information system protects audit information from unauthorized deletion. |
| CCI-001493 |
The information system protects audit tools from unauthorized access. |
| CCI-001494 |
The information system protects audit tools from unauthorized modification. |
| CCI-001495 |
The information system protects audit tools from unauthorized deletion. |
Controls
| Number | Title |
|---|---|
| AU-9 |
Protection Of Audit Information |