Title

Audio devices must be group-owned by root, sys, or bin. (Cat II impact)

Discussion

Without privileged group owners, audio devices will be vulnerable to being used as eaves-dropping devices by malicious users or intruders to possibly listen to conversations containing sensitive information.

Check Content

Check the group-owner of audio devices. Procedure: # ls -lL /dev/audio If the group-owner of an audio device is not root, sys, or bin, this is a finding.

Fix Text

Change the group owner of the audio device. Procedure: # chgrp system <audio device>

Additional Identifiers

Rule ID: SV-227704r603266_rule

Vulnerability ID: V-227704

Group Title: SRG-OS-000480

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.