System audit logs must be owned by root.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-812	GEN002680	SV-37912r1_rule	ECTP-1	Medium

Description
Failure to give ownership of system audit log files to root provides the designated owner and unauthorized users with the potential to access sensitive information.

STIG	Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide	2017-03-01

Details

Check Text ( C-37138r1_chk )
Perform the following to determine the location of audit logs and then check the ownership. Procedure: # grep "^log_file" /etc/audit/auditd.conf|sed s/^[^\/]*//|xargs stat -c %U:%n If any audit log file is not owned by root, this is a finding.

Fix Text (F-966r2_fix)
Change the ownership of the audit log file(s). Procedure: # chown root