Check: AOSX-10-000337
Apple OS X 10-10 Workstation STIG:
AOSX-10-000337
(in versions v1 r5 through v1 r4)
Title
Log files must not contain ACLs. (Cat II impact)
Discussion
The audit service must be configured to create log files with the correct permissions to prevent normal users from reading audit logs. Audit logs contain sensitive data about the system and about users. If log files are set to only be readable and writable by root or administrative users with sudo, the risk is mitigated.
Check Content
To check if a log file contains ACLs, run the following commands: sudo ls -le $(sudo grep '^dir' /etc/security/audit_control | awk -F: '{print $2}') | grep -v current In the output from the above commands, ACLs will be listed under any file that may contain them (e.g., '0: group:admin allow list,readattr,reaadextattr,readsecurity'). If any such line exists, this is a finding.
Fix Text
For any log file that contains ACLs, run the following command: sudo chmod -N [audit log file]
Additional Identifiers
Rule ID: SV-74047r1_rule
Vulnerability ID: V-59617
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000162 |
The information system protects audit information from unauthorized access. |
Controls
Number | Title |
---|---|
AU-9 |
Protection Of Audit Information |