Title

The macOS system must configure audit log files to not contain access control lists (ACLs). (Cat II impact)

Discussion

The audit log files must not contain ACLs. This rule ensures that audit information and audit files are configured to be readable and writable only by system administrators, thereby preventing unauthorized access, modification, and deletion of files. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099

Check Content

Verify the macOS system is configured without ACLs applied to log files with the following command: /bin/ls -le $(/usr/bin/grep '^dir' /etc/security/audit_control | /usr/bin/awk -F: '{print $2}') | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":" If the result is not "0", this is a finding.

Fix Text

Configure the macOS system without ACLs applied to log files with the following command: /bin/chmod -RN /var/audit

Additional Identifiers

Rule ID: SV-268432r1034236_rule

Vulnerability ID: V-268432

Group Title: SRG-OS-000057-GPOS-00027

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.