UCF STIG Viewer Logo

All system audit files must not have extended ACLs.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22369 GEN002710 M6 SV-38102r1_rule ECTP-1 Medium
Description
If a user can write to the audit logs, then audit trails can be modified or destroyed and system intrusion may not be detected.
STIG Date
MAC OSX 10.6 Workstation Security Technical Implementation Guide Draft 2013-01-10

Details

Check Text ( C-37639r1_chk )
Open a terminal session and enter the following command to view the ACLs of the audit files.

ls -Ll /var/audit

If the permissions include a '+', the file has an extended ACL, this is a finding.
Fix Text (F-32880r1_fix)
Open a terminal session and enter the following command to remove the extended ACLs.

chmod -N