The audit log folder must be owned by root:wheel.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-51659	OSX8-00-00215	SV-65869r1_rule		Medium

Description
Non-repudiation of actions taken is required in order to maintain integrity. To do this, we will prevent users from modifying the audit logs. Non-repudiation protects individuals against later claims by an author of not having updated a particular file, invoked a specific command, or copied a specific file.

STIG	Date
Apple OS X 10.8 (Mountain Lion) Workstation STIG	2015-02-10

Details

Check Text ( C-53967r1_chk )
To check the ownership of the audit log files, run the following command: sudo -s ls -dn `sudo grep "^dir" /etc/security/audit_control | awk -F: '{print $2}'`| awk '{ print $3 ":" $4 }' The results should be "0:0". This command shows the UID and GID of the audit logs directory. With the first "0" being root, and the second "0" being wheel. If there is any other result, this is a finding.

Fix Text (F-56461r1_fix)
If the audit log folder is not owned by root:wheel, run the following command: sudo chown root:wheel /var/audit