UCF STIG Viewer Logo

System audit tool executables must not have extended ACLs.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22373 GEN002718 SV-45279r1_rule Low
Description
To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.
STIG Date
SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide 2018-09-19

Details

Check Text ( C-42626r1_chk )
Check the permissions of audit tool executables.
# ls -l /sbin/auditctl /sbin/auditd /sbin/ausearch /sbin/aureport /sbin/autrace /sbin/audispd
If the permissions include a '+' the file has an extended ACL, this is a finding.
Fix Text (F-38675r1_fix)
Remove the extended ACL from the file.
# setfacl --remove-all [audit file]