ACLs for system log files must be set correctly.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-59813	AOSX-10-002107	SV-74243r1_rule		Medium

Description
System logs should only be readable by root or admin users. System logs frequently contain sensitive information that could be used by an attacker. Setting the correct ACLs mitigates this risk.

STIG	Date
Apple OS X 10.10 (Yosemite) Workstation Security Technical Implementation Guide	2016-02-01

Details

Check Text ( C-60569r3_chk )
These commands check for log files that exist on the system and print out the list of ACLs if there are any. sudo ls -ld@ $(grep -v '^#' /etc/newsyslog.conf \| awk '{ print $1 }') 2> /dev/null sudo ls -ld@ $(grep -e '^>' /etc/asl.conf /etc/asl/* \| awk '{ print $2 }') 2> /dev/null ACLs will be listed under any file that may contain them, i.e., '0: group:admin allow list,readattr,reaadextattr,readsecurity'. If any system log file contains this information, this is a finding.

Check Text ( C-60569r3_chk )

These commands check for log files that exist on the system and print out the list of ACLs if there are any.

sudo ls -ld@ $(grep -v '^#' /etc/newsyslog.conf | awk '{ print $1 }') 2> /dev/null
sudo ls -ld@ $(grep -e '^>' /etc/asl.conf /etc/asl/* | awk '{ print $2 }') 2> /dev/null

ACLs will be listed under any file that may contain them, i.e., '0: group:admin allow list,readattr,reaadextattr,readsecurity'.

If any system log file contains this information, this is a finding.

Fix Text (F-65223r1_fix)
For any log file that returns an ACL, run the following command: sudo chmod -N [log file] [log file] is the full path to the log file in question.