The /etc/security/audit_user file must be owned by root.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-226407	GEN000000-SOL00060	SV-226407r603265_rule		Medium

Description
The /etc/security/audit_user is a sensitive file and must be owned by root to prevent possible system compromise.

STIG	Date
Solaris 10 SPARC Security Technical Implementation Guide	2022-09-07

Details

Check Text ( C-28568r482576_chk )
Check /etc/security/audit_user ownership. # ls -lL /etc/security/audit_user If /etc/security/audit_user is not owned by root, this is a finding.

Fix Text (F-28556r482577_fix)
Change the owner of the /etc/security/audit_user file to root. # chown root /etc/security/audit_user