Check: AOSX-10-000332
Apple OS X 10-10 Workstation STIG:
AOSX-10-000332
(in versions v1 r5 through v1 r4)
Title
Audit log folders must be owned by root. (Cat II impact)
Discussion
The audit service must be configured to create log files with the correct ownership to prevent normal users from reading audit logs. Audit logs contain sensitive data about the system and about users. If log files are set to only be readable and writable by root or administrative users with sudo, the risk is mitigated.
Check Content
To check the ownership of the audit log folder, run the following command: sudo ls -lde $(sudo grep '^dir' /etc/security/audit_control | awk -F: '{print $2}') The results should show the owner (third column) to be root. If not, this is a finding.
Fix Text
For any log folder that has an incorrect owner, run the following command: sudo chown root [audit log folder]
Additional Identifiers
Rule ID: SV-74073r1_rule
Vulnerability ID: V-59643
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000162 |
The information system protects audit information from unauthorized access. |
Controls
Number | Title |
---|---|
AU-9 |
Protection Of Audit Information |