ACLs for system log files must be set correctly.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-67651	AOSX-11-002107	SV-82141r1_rule		Medium

Description
System logs should only be readable by root or admin users. System logs frequently contain sensitive information that could be used by an attacker. Setting the correct ACLs mitigates this risk.

STIG	Date
Apple OS X 10.11 Security Technical Implementation Guide	2018-01-04

Details

Check Text ( C-68217r1_chk )
These commands check for log files that exist on the system and print out the list of ACLs if there are any. /usr/bin/sudo ls -ld@ $(/usr/bin/grep -v '^#' /etc/newsyslog.conf \| awk '{ print $1 }') 2> /dev/null /usr/bin/sudo ls -ld@ $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* \| awk '{ print $2 }') 2> /dev/null ACLs will be listed under any file that may contain them, i.e., "0: group:admin allow list,readattr,reaadextattr,readsecurity". If any system log file contains this information, this is a finding.

Check Text ( C-68217r1_chk )

These commands check for log files that exist on the system and print out the list of ACLs if there are any.

/usr/bin/sudo ls -ld@ $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | awk '{ print $1 }') 2> /dev/null
/usr/bin/sudo ls -ld@ $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | awk '{ print $2 }') 2> /dev/null

ACLs will be listed under any file that may contain them, i.e., "0: group:admin allow list,readattr,reaadextattr,readsecurity".

If any system log file contains this information, this is a finding.

Fix Text (F-73765r1_fix)
For any log file that returns an ACL, run the following command: /usr/bin/sudo chmod -N [log file] [log file] is the full path to the log file in question.