Check: AOSX-09-000333
Apple OS X 10.9 Workstation STIG:
AOSX-09-000333
(in version v1 r2)
Title
Audit log files must be group-owned by wheel. (Cat II impact)
Discussion
The audit service must be configured to create log files with the correct group-ownership to prevent normal users from reading audit logs. Audit logs contain sensitive data about the system and about users. If log files are set to only be readable and writable by root or administrative users with sudo, the risk is mitigated.
Check Content
To check the group-ownership of the audit log files, run the following command: sudo ls -le $(sudo grep '^dir' /etc/security/audit_control | awk -F: '{print $2}') | grep -v current The results should show the group owner (fourth column) to be wheel. If not, this is a finding.
Fix Text
For any log file that returns an incorrect group-owner, run the following command: sudo chgrp wheel [audit log file] [audit log file] is the full path to the log file in question.
Additional Identifiers
Rule ID: SV-73325r1_rule
Vulnerability ID: V-58895
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000162 |
The information system protects audit information from unauthorized access. |
Controls
Number | Title |
---|---|
AU-9 |
Protection Of Audit Information |