Detections
Analytics
APPL-15-004001 - The macOS system must configure Apple System Log (ASL) files owned by root and group to wheel.
Information
The Apple System Logs must be owned by root.ASLs contain sensitive data about the system and users. Setting ASL files to be readable and writable only by system administrators mitigates the risk.
Satisfies: SRG-OS-000205-GPOS-00083, SRG-OS-000206-GPOS-00084
Solution
Configure the macOS system with ASL files owned by root and group to wheel with the following command:/usr/sbin/chown root:wheel $(/usr/bin/stat -f '%Su:%Sg:%N' $(/usr/bin/grep -e '^>' /etc/asl.conf /etc/asl/* | /usr/bin/awk '{ print $2 }') 2> /dev/null | /usr/bin/awk '!/^root:wheel:/{print $1}' | /usr/bin/awk -F":" '!/^root:wheel:/{print $3}')
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_macOS_15_V1R7_STIG.zip
Item Details
Audit Name: DISA Apple macOS 15 Sequoia STIG v1r7
Category: SYSTEM AND INFORMATION INTEGRITY
References: 800-53|SI-11a., 800-53|SI-11b., CAT|II, CCI|CCI-001312, CCI|CCI-001314, Rule-ID|SV-268550r1034590_rule, STIG-ID|APPL-15-004001, Vuln-ID|V-268550
Plugin: Unix
Control ID: 57712fb319be24943d908e8bca3ea25ca7fb66187e4d279af4de79edba6b2486