UCF STIG Viewer Logo

The macOS system must be configured with access control lists (ACLs) for system log files to be set correctly.


Overview

Finding ID Version Rule ID IA Controls Severity
V-214931 AOSX-13-002107 SV-214931r609363_rule Medium
Description
System logs should only be readable by root or admin users. System logs frequently contain sensitive information that could be used by an attacker. Setting the correct ACLs mitigates this risk.
STIG Date
Apple OS X 10.13 Security Technical Implementation Guide 2021-11-19

Details

Check Text ( C-16131r397365_chk )
These commands check for log files that exist on the system and print out the list of ACLs if there are any.

/usr/bin/sudo ls -ld@ $(/usr/bin/grep -v '^#' /etc/newsyslog.conf | awk '{ print $1 }') 2> /dev/null
/usr/bin/sudo ls -ld@ $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | awk '{ print $2 }') 2> /dev/null

ACLs will be listed under any file that may contain them (i.e., "0: group:admin allow list,readattr,reaadextattr,readsecurity").

If any system log file contains this information, this is a finding.
Fix Text (F-16129r397366_fix)
For any log file that returns an ACL, run the following command:

/usr/bin/sudo chmod -N [log file]

[log file] is the full path to the log file in question.