The auditing tool, auditd, must be the one provided by Apple, Inc.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-51461	OSX8-00-00415	SV-65671r1_rule		Medium

Description
The auditing tool, auditd, should be the one provided by Apple, Inc.

STIG	Date
Apple OS X 10.8 (Mountain Lion) Workstation STIG	2015-02-10

Details

Check Text ( C-53801r1_chk )
Run the following command to ensure the audit tool, auditd has the correct signed hash value: sudo codesign -dvvv /usr/sbin/auditd 2>&1 | grep CDHash | sed 's/CDHash=//' The result should be "abad487143d9bb99e06d945f69f8fab6e49460f1". If it differs, this is a finding.

Fix Text (F-56263r1_fix)
If the check fails, you will need to obtain the correct files from the original 10.8 installation media.