Detections
Analytics

1.131 APPL-26-004001

Information

The macOS system must configure Apple System Log (ASL) files owned by root and group to wheel.

GROUP ID: V-277158
RULE ID: SV-277158r1148926

The ASL must be owned by root.

ASLs contain sensitive data about the system and users. Setting ASL files to be readable and writable only by system administrators mitigates the risk.

Satisfies: SRG-OS-000205-GPOS-00083, SRG-OS-000206-GPOS-00084

Solution

Configure the macOS system with ASL files owned by root and group to wheel with the following command:

/usr/sbin/chown root:wheel $(/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/awk -F":" '!/^root:wheel:/{print $3}')

See Also

https://workbench.cisecurity.org/benchmarks/26538

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-11a., 800-53|SI-11b., CCI|CCI-001312, CCI|CCI-001314, Rule-ID|SV-277158r1148926_rule, STIG-ID|APPL-26-004001, Vuln-ID|V-277158

Plugin: Unix

Control ID: 20403dcbcdc98ad3f6dcaf79d67a88efdf19fc277b6a57bc37cdfb97967db34e