Title

The macOS system must configure Apple System Log (ASL) files owned by root and group to wheel. (Cat II impact)

Discussion

The ASL must be owned by root. ASLs contain sensitive data about the system and users. Setting ASL files to be readable and writable only by system administrators mitigates the risk. Satisfies: SRG-OS-000205-GPOS-00083, SRG-OS-000206-GPOS-00084

Check Content

Verify the macOS system is configured with ASL files owned by root and group to wheel with the following command: /usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/wc -l | /usr/bin/tr -d ' ' If the result is not "0", this is a finding.

Fix Text

Configure the macOS system with ASL files owned by root and group to wheel with the following command: /usr/sbin/chown root:wheel $(/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/awk -F":" '!/^root:wheel:/{print $3}')

Additional Identifiers

Rule ID: SV-277158r1148926_rule

Vulnerability ID: V-277158

Group Title: SRG-OS-000205-GPOS-00083

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.