System audit tool executables must not have extended ACLs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22373	GEN002718	SV-26516r1_rule	ECLP-1	Low

Description
To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.

STIG	Date
HP-UX 11.31 Security Technical Implementation Guide	2013-03-28

Details

Check Text ( C-36440r2_chk )
Check the permissions of audit tool executables. # ls -lL /usr/sbin/audfilter /usr/sbin/auditdp If audit tool executables are not found, this check is not applicable. If one or more audit tools is found and the file permissions include a "+" the file has an extended ACL, this is a finding.

Fix Text (F-31779r1_fix)
Remove the optional ACL from the file. # chacl -z [audit file]