GEN002718 - System audit tool executables must not have extended ACLs.

Information

To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.

Solution

Remove the extended ACL from the file.
# chmod A- [audit file]

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_SOL_10_SPARC_V2R4_STIG.zip

Item Details

Audit Name: DISA STIG Solaris 10 SPARC v2r4

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9, CAT|III, CCI|CCI-001493, Rule-ID|SV-226597r603265_rule, STIG-ID|GEN002718, STIG-Legacy|SV-26515, STIG-Legacy|V-22373, Vuln-ID|V-226597

Plugin: Unix

Control ID: 451c9ac128efd7fbc93ee3fe8dd2f63685546313541c99d80c22716a3383cecf