Check: AOSX-10-000334
Apple OS X 10-10 Workstation STIG:
AOSX-10-000334
(in versions v1 r5 through v1 r4)
Title
Audit log folders must be group-owned by wheel. (Cat II impact)
Discussion
The audit service must be configured to create log files with the correct group-ownership to prevent normal users from reading audit logs. Audit logs contain sensitive data about the system and about users. If log files are set to only be readable and writable by root or administrative users with sudo, the risk is mitigated.
Check Content
To check the group-ownership of the audit log folder, run the following command: sudo ls -lde $(sudo grep '^dir' /etc/security/audit_control | awk -F: '{print $2}') The results should show the group (fourth column) to be wheel. If not, this is a finding.
Fix Text
For any log folder that has an incorrect group, run the following command: sudo chgrp wheel [audit log folder]
Additional Identifiers
Rule ID: SV-74041r1_rule
Vulnerability ID: V-59611
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000162 |
The information system protects audit information from unauthorized access. |
Controls
Number | Title |
---|---|
AU-9 |
Protection Of Audit Information |